CVE-2019-19783: Medium severity Cyrus IMAP vulnerability
An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosievecreatefolder() in imap/lmtpsieve.c.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19783?
CVE-2019-19783 is classified as a medium severity vulnerability affecting Cyrus IMAP server.
How do I fix CVE-2019-19783?
To fix CVE-2019-19783, upgrade to a version of Cyrus IMAP that is at least 2.5.15, 3.0.13, or 3.1.8.
What versions of Cyrus IMAP are vulnerable to CVE-2019-19783?
CVE-2019-19783 affects Cyrus IMAP versions before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8.
Who can exploit CVE-2019-19783?
A user with a mail account on the Cyrus IMAP service can exploit CVE-2019-19783 if sieve script uploading is allowed or certain non-default sieve options are enabled.
What impact does CVE-2019-19783 have?
CVE-2019-19783 allows a user to use a sieve script containing a fileinto directive, potentially leading to unauthorized access to emails.