Detections
Analytics

CVE-2019-18928

critical

Description

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

References

https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.12.html

https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.14.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAGKPZDXQ6KRUGQVRAO6N4PCINP6KS5F/

https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8601

Details

Source: Mitre, NVD

Published: 2019-11-15

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.02392