CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8

published December 16, 2019

CVSS
—
EPSS
2%
Percentile
76.4
In the wild
Unconfirmed
What it is

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01655 · 76.4th percentile
Published
2019-12-16T13:06Z
EPSS history
Timeline
  • 16 DEC 13:06Z
    An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8
    cvelistv5