CVE-2019-18928critical
Description
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
References
https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.14.html
https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.12.html
https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html
Details
Source: MITRE
Published: 2019-11-15
Updated: 2023-02-10
Type: NVD-CWE-noinfo
Risk Information
CVSS v2
Base Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 10
Severity: HIGH
CVSS v3
Base Score: 9.8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 3.9
Severity: CRITICAL