Every CVE Search/ Get API key

CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8...

6.5 MediumFix available

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.65%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

Record
CVE-2019-19783
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-269
Updated
2026-11-02
CVE List No score

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

Record
CVE-2019-19783
Updated
2026-11-02
EUVDEUVD-2019-9382 No score

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

Record
EUVD-2019-9382
Updated
2026-11-03
GitHub AdvisoriesGHSA-rv2p-w5h4-rfg3 6.5

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8...

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

Record
GHSA-rv2p-w5h4-rfg3
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20, CWE-269
Updated
2026-11-02
OSV 6.5

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

Record
CVE-2019-19783
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2019-19783 6.5

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

Record
DEBIAN-CVE-2019-19783
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2020:4655 7.4

Red Hat Security Advisory: cyrus-imapd security update

Record
RHSA-2020:4655
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2019-19783 6.5

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

Record
UBUNTU-CVE-2019-19783
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVMGASA-2020-0010 No score

Updated cyrus-imapd packages fix security vulnerability

Updated cyrus-imapd packages fix security vulnerability:

It was discovered that the lmtpd component of the Cyrus IMAP server created mailboxes with administrator privileges if the "fileinto" was used, bypassing ACL checks (CVE-2019-19783).

Record
MGASA-2020-0010
Updated
2026-11-02
OSVopenSUSE-SU-2025:14968-1 No score

cyradm-3.8.4-1.1 on GA media

These are all security issues fixed in the cyradm-3.8.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14968-1
Updated
2026-11-02
OSVUSN-4566-1 No score

cyrus-imapd vulnerabilities

It was dicovered that Cyrus IMAP Server could execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name. An attacker could use this vulnerability to cause a crash or possibly execute arbitrary code. (CVE-2019-11356)

It was discovered that the Cyrus IMAP Server allow users to create any mailbox with administrative privileges. A local attacker could use this to obtain sensitive information. (CVE-2019-19783)

Record
USN-4566-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cyrus-imapd
Debian:12
 before 3.0.13-1
3.0.13-1
cyrus-imapd
Debian:13
 before 3.0.13-1
3.0.13-1
cyrus-imapd
Debian:14
 before 3.0.13-1
3.0.13-1
cyrus-imapd
Debian:9
 before 2.5.10-3+deb9u2, plus listed versions
2.5.10-32.5.10-3+deb9u1
2.5.10-3+deb9u2
cyrus-imapd
Debian:10
 before 3.0.8-6+deb10u3, plus listed versions
3.0.8-63.0.8-6+deb10u1
3.0.8-6+deb10u3
cyrus-imapd
Mageia:7
 before 2.5.15-1.mga7
2.5.15-1.mga7
cyrus-imapd
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-utils
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
Show 6 moreShow less
Affected packages
PackageAffectedFixed
cyrus-imapd-utils-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-vzic
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-vzic-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd
Ubuntu:18.04:LTS
 before 2.5.10-3ubuntu1.1, plus listed versions
2.5.10-3build12.5.10-3build22.5.10-3ubuntu1
2.5.10-3ubuntu1.1
cyrus-imapd
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 2.5.10-3ubuntu1.1, plus listed versions
2.5.10-3build12.5.10-3build22.5.10-3ubuntu1
2.5.10-3ubuntu1.1
cyrus-imapd
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.8.4-1.1
3.8.4-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-19783 is a medium vulnerability (CVSS 6.5) in Cyrus Imap, published December 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in cyrus-imapd 3.0.13-1.

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open