Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-cyrus-imapdalma-upgrade-cyrus-imapd-utilsalma-upgrade-cyrus-imapd-vzic | May 4, 2022 | Nov 15, 2019 | |
| Centos_linux | — | centos-upgrade-cyrus-imapdcentos-upgrade-cyrus-imapd-debuginfocentos-upgrade-cyrus-imapd-debugsourcecentos-upgrade-cyrus-imapd-utilscentos-upgrade-cyrus-imapd-utils-debuginfocentos-upgrade-cyrus-imapd-vziccentos-upgrade-cyrus-imapd-vzic-debuginfo | Nov 5, 2020 | Nov 15, 2019 |
| Debian | debian-upgrade-cyrus-imapd | Jun 21, 2022 | Nov 15, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-cyrus-imapdoracle-linux-upgrade-cyrus-imapd-utilsoracle-linux-upgrade-cyrus-imapd-vzic | Nov 12, 2020 | Nov 14, 2019 |
| Redhat_linux | redhat-upgrade-cyrus-imapdredhat-upgrade-cyrus-imapd-debuginforedhat-upgrade-cyrus-imapd-debugsourceredhat-upgrade-cyrus-imapd-utilsredhat-upgrade-cyrus-imapd-utils-debuginforedhat-upgrade-cyrus-imapd-vzicredhat-upgrade-cyrus-imapd-vzic-debuginfo | Nov 5, 2020 | Nov 15, 2019 | |
| Ubuntu | ubuntu-pro-upgrade-cyrus-adminubuntu-pro-upgrade-cyrus-caldavubuntu-pro-upgrade-cyrus-clientsubuntu-pro-upgrade-cyrus-commonubuntu-pro-upgrade-cyrus-devubuntu-pro-upgrade-cyrus-imapdubuntu-pro-upgrade-cyrus-murderubuntu-pro-upgrade-cyrus-nntpdubuntu-pro-upgrade-cyrus-pop3dubuntu-pro-upgrade-cyrus-replicationubuntu-pro-upgrade-libcyrus-imap-perl | Nov 19, 2024 | Nov 15, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub