CVE-2011-1926

CVE-2011-1926 describes a plaintext command injection vulnerability in the STARTTLS implementation of Cyrus IMAP Server versions prior to 2.4.7. This flaw allows man-in-the-middle attackers to inject commands into encrypted sessions by sending cleartext commands that are processed after TLS is established. With a CVSS score of 5.1, this vulnerability has a network attack vector and high attack complexity, potentially leading to partial compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.