Vulnerability · Published Nov 1, 2020 · Assigned by twcert

CVE-2020-25849Openfind MailGates/MailAudit - Command Injection

High 8.8

In plain English

A high-severity OS command injection in MailAudit from Openfind. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)2.2%top 17.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parameter after attackers obtain the user’s access token.

Affected products (as reported)

Vendor	Product	Versions
Openfind	MailGates	0 – through 5.0
Openfind	MailAudit	0 – through 5.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.twcert.org.tw/tw/cp-132-4118-6292c-1.html x_refsource_MISC