PT-2020-16244 · Mailgates+1 · Mailgates+1

Published 2020-11-01 · Updated 2020-11-13 · CVE-2020-25849

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MailGates and MailAudit products (affected versions not specified)

Description The issue allows attackers to inject and execute system commands from the cgi parameter after obtaining the user's access token. This can be used to exploit the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-25849

Affected Products

Mailaudit

Mailgates

References · 4

• https://osv.dev/vulnerability/CVE-2020-25849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25849 · Security Note
• https://twcert.org.tw/tw/cp-132-4118-6292c-1.html · Note
• https://t.me/cibsecurity/15759 · Telegram Post