Monthly
SMTP smuggling in Open-Xchange's OX Dovecot Pro and Community Edition allows an unauthenticated attacker to inject forged SMTP commands into messages relayed through Dovecot, bypassing its outbound content-sanitization logic. By embedding crafted bare carriage return sequences in a message body - delivered via Sieve redirect or submission relay - the attacker causes a vulnerable downstream mail server to misinterpret message body content as new SMTP envelope commands, enabling injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 (Postfix) and CVE-2023-51766 (Exim); no public exploit code exists and the CVE is not listed in CISA's KEV catalog.
SMTP smuggling in Open-Xchange's OX Dovecot Pro and Community Edition allows an unauthenticated attacker to inject forged SMTP commands into messages relayed through Dovecot, bypassing its outbound content-sanitization logic. By embedding crafted bare carriage return sequences in a message body - delivered via Sieve redirect or submission relay - the attacker causes a vulnerable downstream mail server to misinterpret message body content as new SMTP envelope commands, enabling injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 (Postfix) and CVE-2023-51766 (Exim); no public exploit code exists and the CVE is not listed in CISA's KEV catalog.