Vulnerability Name:

CVE-2021-32056 (CCN-201522)

Assigned:2021-05-10
Published:2021-05-10
Updated:2022-04-01
Summary:Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall.
CVSS v3 Severity:4.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
3.8 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-732
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2021-32056

Source: CONFIRM
Type: Patch, Release Notes, Vendor Advisory
https://cyrus.topicbox.com/groups/announce/T056901c106ecfce3/cyrus-imap-3-4-1-released

Source: CCN
Type: Cyrus Web site
Cyrus IMAP

Source: CONFIRM
Type: Patch, Release Notes, Vendor Advisory
https://cyrus.topicbox.com/groups/announce/T126392718bc29d6b/cyrus-imap-3-2-7-released

Source: XF
Type: UNKNOWN
cyrus-cve202132056-dos(201522)

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2022-d45bcc5447

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2022-c30b1a8aa3

Source: CONFIRM
Type: Patch, Release Notes, Vendor Advisory
https://www.cyrusimap.org/imap/download/release-notes/3.2/x/3.2.7.html

Source: CONFIRM
Type: Patch, Release Notes, Vendor Advisory
https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.1.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cyrus:imap:*:*:*:*:*:*:*:* (Version < 3.2.7)
  • OR cpe:/a:cyrus:imap:*:*:*:*:*:*:*:* (Version >= 3.3.0 and < 3.4.1)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:35:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cyrus imap *
    cyrus imap *
    fedoraproject fedora 34
    fedoraproject fedora 35