Description
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| psyb0t | docker-mailbox | 0.1.0 – ≤ 0.4.12 | — |