CVE-2019-19783

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-19783
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19783.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-19783
Related
Published
2019-12-16T14:15:12Z
Modified
2024-06-06T12:40:58.775132Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosievecreatefolder() in imap/lmtpsieve.c.

References

Affected packages

Git / github.com/cyrusimap/cyrus-imapd

Affected ranges

Type
GIT
Repo
https://github.com/cyrusimap/cyrus-imapd
Events

Affected versions

cyrus-imapd-2.*

cyrus-imapd-2.5.0
cyrus-imapd-2.5.1
cyrus-imapd-2.5.10
cyrus-imapd-2.5.11
cyrus-imapd-2.5.12
cyrus-imapd-2.5.13
cyrus-imapd-2.5.14
cyrus-imapd-2.5.2
cyrus-imapd-2.5.3
cyrus-imapd-2.5.4
cyrus-imapd-2.5.5
cyrus-imapd-2.5.6
cyrus-imapd-2.5.7
cyrus-imapd-2.5.8
cyrus-imapd-2.5.9