CVE-2011-1926: cmu cyrus_imap_server

Vulnerability summary

CVE-2011-1926 is a medium (CVSS 5.1) vulnerability in cmu cyrus_imap_server. EPSS estimates a 4.00% chance of exploitation in the next 30 days, higher than 90.4% of scored vulnerabilities.

Timeline

1. 23-05-2011
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.