Read the docs
TI-2013-03745 Aliases CVE-2013-4279GHSA-9wf9-q5vr-wvw9

imapsync 1.564 and earlier performs a release check by default, which sends sensitive…

Priority LOW 27CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

imapsync 1.564 and earlier performs a release check by default, which sends sensitive information (imapsync, operating system, and Perl version) to the developer's site.

Why it matters now

EPSS 0.01838 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:imapsync_project:imapsync:*:*:*:*:*:*:*:*up to 1.564VulnerableImapsync Project
cpe:2.3:a:imapsync_project:imapsync:1.53:*:*:*:*:*:*:*1.53VulnerableImapsync Project
cpe:2.3:a:imapsync_project:imapsync:1.500:*:*:*:*:*:*:*1.500VulnerableImapsync Project
cpe:2.3:a:imapsync_project:imapsync:1.504:*:*:*:*:*:*:*1.504VulnerableImapsync Project
cpe:2.3:a:imapsync_project:imapsync:1.508:*:*:*:*:*:*:*1.508VulnerableImapsync Project
cpe:2.3:a:imapsync_project:imapsync:1.516:*:*:*:*:*:*:*1.516VulnerableImapsync Project
cpe:2.3:a:imapsync_project:imapsync:1.518:*:*:*:*:*:*:*1.518VulnerableImapsync Project
cpe:2.3:a:imapsync_project:imapsync:1.525:*:*:*:*:*:*:*1.525VulnerableImapsync Project
cpe:2.3:a:imapsync_project:imapsync:1.542:*:*:*:*:*:*:*1.542VulnerableImapsync Project
cpe:2.3:a:imapsync_project:imapsync:1.547:*:*:*:*:*:*:*1.547VulnerableImapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:*:*:*:*:*:*:*:* Versions up to 1.564 Vulnerable ·Imapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.53:*:*:*:*:*:*:* Versions 1.53 Vulnerable ·Imapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.500:*:*:*:*:*:*:* Versions 1.500 Vulnerable ·Imapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.504:*:*:*:*:*:*:* Versions 1.504 Vulnerable ·Imapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.508:*:*:*:*:*:*:* Versions 1.508 Vulnerable ·Imapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.516:*:*:*:*:*:*:* Versions 1.516 Vulnerable ·Imapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.518:*:*:*:*:*:*:* Versions 1.518 Vulnerable ·Imapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.525:*:*:*:*:*:*:* Versions 1.525 Vulnerable ·Imapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.542:*:*:*:*:*:*:* Versions 1.542 Vulnerable ·Imapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.547:*:*:*:*:*:*:* Versions 1.547 Vulnerable ·Imapsync Project
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:imapsync_project:imapsync:1.554:*:*:*:*:*:*:*1.554VulnerableImapsync Project
cpe:2.3:a:imapsync_project:imapsync:1.558:*:*:*:*:*:*:*1.558VulnerableImapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.554:*:*:*:*:*:*:* Versions 1.554 Vulnerable ·Imapsync Project
  • cpe:2.3:a:imapsync_project:imapsync:1.558:*:*:*:*:*:*:* Versions 1.558 Vulnerable ·Imapsync Project

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4279
  2. 2026-10-03 Alias added: GHSA-9wf9-q5vr-wvw9

References

Exploit 1

Advisory 2

  • TI-2023-17042 imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode… CVSS 3.1MEDIUM 6.5
  • TI-2014-01578 imapsync before 1.584, when running with the --tls option, attempts a cleartext login… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences