PT-2019-15720 · Cyrus+5 · Cyrus Imap+5

Published 2019-11-15 · Updated 2025-04-04 · CVE-2019-18928

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions 2.5.x through 2.5.13 Cyrus IMAP versions 3.x through 3.0.11

Description The issue allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Recommendations For Cyrus IMAP versions 2.5.x through 2.5.13, update to version 2.5.14 or later. For Cyrus IMAP versions 3.x through 3.0.11, update to version 3.0.12 or later.

Fix

Related Identifiers

ALT-PU-2019-3147

ALT-PU-2019-3158

CESA-2020_4655

CVE-2019-18928

DLA-3052-1

OPENSUSE-SU-2025:14968-1

RHSA-2020:4655

RHSA-2020_4655

USN-7224-1

Affected Products

Alt Linux

Centos

Cyrus Imap

Linuxmint

Red Hat

Ubuntu

References · 40

• https://ubuntu.com/security/CVE-2021-33582 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01804 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-18928 · Vendor Advisory
• https://cyrusimap.org/imap/download/release-notes/2.5/x/2.5.14.html · Patch
• https://errata.altlinux.org/ALT-PU-2019-3147 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34055 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAGKPZDXQ6KRUGQVRAO6N4PCINP6KS5F · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19783 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18928 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7224-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-34055 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3052-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/cyrus-imapd · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18928 · Security Note