Vulnerability Database

311,377

Total vulnerabilities in the database

CVE-2019-18928

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

  • Published: Nov 15, 2019
  • Updated: Nov 9, 2025
  • CVE: CVE-2019-18928
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.8
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

No CWE or OWASP classifications available.

Software From Fixed in
cyrus / imap 2.5.0 2.5.14
cyrus / imap 3.0.0 3.0.12
fedoraproject / fedora 30 30.x
fedoraproject / fedora 31 31.x
debian / debian_linux 9.0 9.0.x