Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

cyradm-3.8.4-1.1 on GA media

Affected: Ubuntu:Pro:18.04:LTS: cyrus-imapd, Ubuntu:20.04:LTS: cyrus-imapd

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in cyrus imapd ausnutzen, um Sicherheitsvorkehrungen zu umgehen.