{"id":"CVE-2019-19783","aliases":["DEBIAN-CVE-2019-19783","DSA-4590-1","EUVD-2019-9382","GHSA-rv2p-w5h4-rfg3","MGASA-2020-0010","RHSA-2020:4655","UBUNTU-CVE-2019-19783","USN-4566-1","openSUSE-SU-2025:14968-1"],"status":"published","title":"An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8...","description":"An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01655,"percentile":0.76717,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-269"],"published":"2019-12-16T13:06:54Z","modified":"2026-10-24T10:30:50Z","fixes":[{"ecosystem":"Debian:12","package":"cyrus-imapd","fixed_in":["3.0.13-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cyrus-imapd","fixed_in":["3.0.13-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cyrus-imapd","fixed_in":["3.0.13-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"cyrus-imapd","fixed_in":["2.5.10-3+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"cyrus-imapd","fixed_in":["3.0.8-6+deb10u3"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"cyrus-imapd","fixed_in":["2.5.15-1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"cyrus-imapd","fixed_in":["2.5.10-3ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3+deb9u2"}]}],"versions":["2.5.10-3","2.5.10-3+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-6+deb10u3"}]}],"versions":["3.0.8-6","3.0.8-6+deb10u1"]},{"source":"osv","ecosystem":"Mageia:7","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.15-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-19.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-19.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-19.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-19.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-19.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-vzic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-19.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cyrus-imapd-vzic-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-19.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1"}]}],"versions":["2.5.10-3build1","2.5.10-3build2","2.5.10-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3ubuntu1.1"}]}],"versions":["2.5.10-3build1","2.5.10-3build2","2.5.10-3ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1.1"}]}],"bundled":4}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"cyrus","product":"imap"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.15.html","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Vendor Advisory","fix","web","report"]},{"url":"https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.13.html","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Vendor Advisory","fix","report"]},{"url":"https://seclists.org/bugtraq/2019/Dec/38","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4590","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIV4HQ6LG5GPRO4B5Z2NHCZUPBUVVVF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGOO5UGEBBDPN7B2YXLK7I7L3Y35EBA/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202006-23","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4566-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19783","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DIV4HQ6LG5GPRO4B5Z2NHCZUPBUVVVF/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6IGOO5UGEBBDPN7B2YXLK7I7L3Y35EBA/"},{"url":"https://github.com/advisories/GHSA-rv2p-w5h4-rfg3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19783","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0010.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25913","tags":["report"]},{"url":"https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.12.html","tags":["web"]},{"url":"https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.13.html","tags":["web"]},{"url":"https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.14.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4655","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671239","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1786756","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4655.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-18928","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18928","tags":["advisory"]},{"url":"https://github.com/cyrusimap/cyrus-imapd/issues/2904","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19783","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2019-19783","tags":["report"]},{"url":"https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.13.html#security-fixes","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4566-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-11356","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34055","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-19783","description":"An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.","status":"published","published":"2019-12-16T13:06:54Z","modified":"2024-08-05T02:25:12.659Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-9382","description":"An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.","status":"published","published":"2019-12-16T13:06:54Z","modified":"2024-08-05T02:25:12Z","updated_at":"2026-11-03T02:40:24.313121Z"}],"ghsa":[{"id":"GHSA-rv2p-w5h4-rfg3","title":"An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8...","description":"An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.","status":"published","published":"2022-05-24T17:03:41Z","modified":"2023-01-29T05:00:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20","CWE-269"],"updated_at":"2026-11-02T14:44:38.905828Z"}],"nvd":[{"id":"CVE-2019-19783","description":"An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.","status":"published","published":"2019-12-16T14:15:12.257Z","modified":"2026-06-17T02:27:14.477Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:05:40.258829Z"}],"osv":[{"id":"CVE-2019-19783","description":"An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.","status":"published","published":"2019-12-16T14:15:12.257Z","modified":"2026-10-24T10:30:50.958843785Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19783","description":"An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.","status":"published","published":"2019-12-16T14:15:12.257Z","modified":"2026-09-21T07:03:16.14137348Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2020:4655","title":"Red Hat Security Advisory: cyrus-imapd security update","status":"published","published":"2024-09-16T04:04:54Z","modified":"2025-11-22T12:11:37Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2019-19783","description":"An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.","status":"published","published":"2019-12-16T14:15:00Z","modified":"2026-04-22T12:16:27.191521Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DSA-4590-1","title":"cyrus-imapd - security update","status":"published","published":"2019-12-19T00:00:00Z","modified":"2026-03-09T02:10:30.988964Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0010","title":"Updated cyrus-imapd packages fix security vulnerability","description":"Updated cyrus-imapd packages fix security vulnerability:\n\nIt was discovered that the lmtpd component of the Cyrus IMAP server\ncreated mailboxes with administrator privileges if the \"fileinto\" was\nused, bypassing ACL checks (CVE-2019-19783).\n","status":"published","published":"2020-01-05T15:37:51Z","modified":"2026-04-16T04:42:43.359042325Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2025:14968-1","title":"cyradm-3.8.4-1.1 on GA media","description":"These are all security issues fixed in the cyradm-3.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-04T00:00:00Z","modified":"2026-02-04T04:07:09.050202Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"USN-4566-1","title":"cyrus-imapd vulnerabilities","description":"It was dicovered that Cyrus IMAP Server could execute arbitrary code via a\ncrafted HTTP PUT operation for an event with a long iCalendar property name.\nAn attacker could use this vulnerability to cause a crash or possibly execute\narbitrary code. (CVE-2019-11356)\n\nIt was discovered that the Cyrus IMAP Server allow users to create any\nmailbox with administrative privileges. A local attacker could use this to\nobtain sensitive information. (CVE-2019-19783)\n","status":"published","published":"2020-10-05T17:25:10Z","modified":"2026-04-22T10:08:24.363061Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}