VULNERABILITY INTELLIGENCE
CVE-2019-18928
CVSS score9.8 CRITICAL
EPSS probability2.39%
CISA KEVNot currently listed
Published2019-11-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
Primary references
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org — Patch, Release Notes, Third Party Advisory
- cve@mitre.org — Patch, Release Notes, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Release Notes, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Release Notes, Third Party Advisory