The vulnerability involves improper control of resource identifiers, specifically a 'Resource Injection' issue in OX Dovecot Pro. An attacker who can position themselves between the client and the Dovecot server can manipulate the base64 exchange used in SCRAM TLS channel binding to fake the binding. This manipulation enables the attacker to intercept and eavesdrop on communications as a man-in-the-middle proxy. The attack requires network-level access to intercept traffic. No known public exploits currently exist. The CVSS 3.1 vector indicates the attack requires adjacent network access, high attack complexity, no privileges, no user interaction, unchanged scope, and impacts confidentiality and integrity but not availability.

Successful exploitation allows an attacker positioned between the client and server to eavesdrop on communications by faking SCRAM TLS channel binding, compromising confidentiality and integrity of the data exchanged. There is no impact on availability. No public exploits are known, which limits immediate risk. The attack requires network-level access to intercept traffic, which may limit exposure depending on deployment environment.

The vendor advisory does not specify a remediation level or patch availability. Users should monitor Open-Xchange GmbH communications for a fixed version and apply it promptly once released. Until then, mitigating the ability of attackers to position themselves between client and server (e.g., through network segmentation or VPNs) may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.