Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2019-3814

24
FAUCET Score

CVE-2019-3814 describes a vulnerability in Dovecot versions prior to 2.2.36.1 and 2.3.4.1, where incorrect handling of client certificates could allow a remote attacker with a valid certificate and an empty username field to impersonate other users. This medium-severity flaw (CVSS 6.8) has a network attack vector and high impact on confidentiality and integrity, but requires high attack complexity and low privileges. There is no evidence of active exploitation, public exploit code, or significant community discussion or media coverage for this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
>= 1.1.0, < 2.2.36.1CPE matchmatch criteria
cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*
>= 2.3.0, < 2.3.4.1CPE matchmatch criteria
cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*
12.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
14.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
16.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

CVSS Data

CVSS version used by this source: 3.0

7.7HIGH

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
1.3
Impact Score
5.8
CvssVersion
3.0

Exploit Intelligence

EPSS Score
2.42%
Probability of exploitation in next 30 days
EPSS Percentile
82.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0242 is in the 90th percentile among its peer group of 1,428 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (11)

denopatch availablevia llm_extracted
View patch
drupalpatch availablevia llm_extracted
View patch
freeswitchpatch availablevia llm_extracted
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: dovecot-1:2.2.36-10.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: dovecot-1:2.2.36-6.el7
View patch
synologypatch availablevia llm_extracted
Fixed in: null
View patch
boschvendor investigatingvia llm_extracted
View patch
broadcomvendor investigatingvia llm_extracted
View patch
ubiquitivendor investigatingvia llm_extracted
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: dovecot
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: dovecot

Vendor Advisories (8)

redhatCVE-2019-3814Moderate

dovecot: Improper certificate validation

Feb 5, 2019
drupalllm-drupal-3386f1e7f2de0314

Suitable client certificate can be used to login as other user

Feb 5, 2019
ubiquitillm-ubiquiti-16d564a151102ea2

Suitable client certificate can be used to login as other user

Feb 5, 2019
synologyllm-synology-c7d235dcd0123814

Suitable client certificate can be used to login as other user

Feb 5, 2019
denollm-deno-ea0ae074551f4d6c

Suitable client certificate can be used to login as other user

Feb 5, 2019
broadcomllm-broadcom-845689044dc8f3f9

CVE-2019-3814: Suitable client certificate can be used to login as other user

Feb 5, 2019
freeswitchllm-freeswitch-162d16b5458e8d70

Suitable client certificate can be used to login as other user

Feb 5, 2019
boschllm-bosch-039d5e1837d51e67

CVE-2019-3814: Suitable client certificate can be used to login as other user

Feb 5, 2019

References

lists.opensuse.org / opensuse-security-announce/2019-04/msg00067.html
Mailing ListThird Party Advisory
access.redhat.com / errata/RHSA-2019:3467
bugzilla.redhat.com / show_bug.cgi
Issue TrackingRelease NotesThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/4XLI55NGRDTGMVOPYFCPPFNPA5VKYSSY
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/QHFZ5OWRIZGIWZJ5PTNVWWZNLLNH4XYS
security.gentoo.org / glsa/201904-19
dovecot.org / list/dovecot/2019-February/114575.html
ExploitMailing ListVendor Advisory