Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cyrus-imapd-utilsUpgrade cyrus-imapdUpgrade cyrus-imapd-vzic | May 4, 2022 | Nov 15, 2019 |
| Centos_linux | — | Upgrade cyrus-imapdUpgrade cyrus-imapd-debuginfoUpgrade cyrus-imapd-vzic-debuginfoUpgrade cyrus-imapd-utils-debuginfoUpgrade cyrus-imapd-debugsourceUpgrade cyrus-imapd-vzicUpgrade cyrus-imapd-utils | Nov 5, 2020 | Nov 15, 2019 |
| Debian | — | Upgrade cyrus-imapd | Jun 21, 2022 | Nov 15, 2019 |
| Oracle_linux | — | Upgrade cyrus-imapd-vzicUpgrade cyrus-imapd-utilsUpgrade cyrus-imapd | Nov 12, 2020 | Nov 14, 2019 |
| Redhat_linux | — | Upgrade cyrus-imapd-debuginfoUpgrade cyrus-imapd-utilsUpgrade cyrus-imapd-vzicUpgrade cyrus-imapd-utils-debuginfoUpgrade cyrus-imapdUpgrade cyrus-imapd-debugsourceUpgrade cyrus-imapd-vzic-debuginfo | Nov 5, 2020 | Nov 15, 2019 |
| Ubuntu | — | Upgrade cyrus-replication (Ubuntu Pro)Upgrade cyrus-caldav (Ubuntu Pro)Upgrade cyrus-admin (Ubuntu Pro)Upgrade cyrus-nntpd (Ubuntu Pro)Upgrade cyrus-imapd (Ubuntu Pro)Upgrade cyrus-dev (Ubuntu Pro)Upgrade cyrus-common (Ubuntu Pro)Upgrade cyrus-pop3d (Ubuntu Pro)Upgrade cyrus-clients (Ubuntu Pro)Upgrade libcyrus-imap-perl (Ubuntu Pro)Upgrade cyrus-murder (Ubuntu Pro) | Nov 19, 2024 | Nov 15, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub