PT-2020-13222 · Ciphermail · Ciphermail Webmail Messenger+2

Pablo A. Zurro · Published 2020-06-11 · Updated 2020-06-22 · CVE-2020-12713

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CipherMail Community Gateway and Professional/Enterprise Gateway versions 1.0.1 through 4.7.1-0 CipherMail Webmail Messenger versions 1.1.1 through 3.1.1-0

Description An issue was discovered that allows attackers with administrative access to the web interface to escalate their privileges to the Unix root account. This is possible due to multiple options available to attackers.

Recommendations For CipherMail Community Gateway and Professional/Enterprise Gateway versions 1.0.1 through 4.7.1-0, update to a version outside of this range to mitigate the risk. For CipherMail Webmail Messenger versions 1.1.1 through 3.1.1-0, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting administrative access to the web interface until a patch is available.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-12713

Affected Products

Ciphermail Community Gateway

Ciphermail Professional/Enterprise Gateway

Ciphermail Webmail Messenger

References · 9

• 🔥 http://packetstormsecurity.com/files/158001/CipherMail-Community-Virtual-Appliance-4.6.2-Code-Execution.html · Exploit
• 🔥 https://coresecurity.com/core-labs/advisories/ciphermail-multiple-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12713 · Security Note
• https://ciphermail.com/blog/ciphermail-cve-2020-12713_2020-12714.html · Vendor Advisory
• https://ciphermail.com/secure-webmail.html · Vendor Advisory
• https://ciphermail.com/gateway.html · Vendor Advisory
• https://ciphermail.com/news.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12713 · Vendor Advisory
• https://t.me/cvenotify/4296 · Telegram Post