Skip to content
Fencer Intel
medium 6.5

CVE-2019-19783 json

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8.

published 2019-12-16 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-9382

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.

Patch / fix

  • cyrus imap 2.5.15, 3.0.13, 3.1.8
  • cyrus-imapd Debian 14, Debian 13, Debian 12 3.0.13-1

debian advisories DEBIAN-CVE-2019-19783

  • cyrus-imapd Ubuntu 18.04 LTS 2.5.10-3ubuntu1.1

ubuntu advisories UBUNTU-CVE-2019-19783

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cyrus-imapd RHEL 8 3.0.7-19.el8
  • cyrus-imapd-vzic RHEL 8 3.0.7-19.el8
  • cyrus-imapd-utils RHEL 8 3.0.7-19.el8

red hat advisories RHSA-2020:4655

  • cyrus-imapd openSUSE Tumbleweed 3.8.4-1.1

opensuse advisories openSUSE-SU-2025:14968-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-19783 updated cvss 6.5

cyrus-imapd: lmtpd component created mailboxes with administrator privileges if the "fileinto" was used, bypassing ACL checks

  • Red Hat Enterprise Linux 5 cyrus-imapd Red Hat Enterprise Linux 6 cyrus-imapd, cyrus-imapd-utils Red Hat Enterprise Linux 7 cyrus-imapd, cyrus-imapd-utils
    affected: workaround, no fix planned “This flaw can be mitigated by: 1. In cyrus-imapd >= 2.5 disable anysievefolder (it is disabled by default) 2. In cyrus-imapd >=3.0 disable sieve_extensions”
  • Red Hat Enterprise Linux AppStream (v. 8) cyrus-imapd 3.0.7-19.el8, cyrus-imapd-vzic 3.0.7-19.el8, cyrus-imapd-utils 3.0.7-19.el8
    fixed: vendor fix “This flaw can be mitigated by: 1. In cyrus-imapd >= 2.5 disable anysievefolder (it is disabled by default) 2. In cyrus-imapd >=3.0 disable sieve_extensions” RHSA-2020:4655

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.