PT-2020-18335 · Mailu · Mailu

Highkaiyou · Published 2020-02-13 · Updated 2020-02-18 · CVE-2020-5239

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mailu versions prior to 1.7

Description An authenticated user can exploit a vulnerability in the Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers with open registration or untrusted users are most impacted.

Recommendations For versions prior to 1.7, update to version 1.7 or later, where the master and 1.7 branches are patched on the git repository. Additionally, use the patched Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7, and master. Follow the detailed instructions about patching and securing the server afterwards.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-5239

GHSA-2467-P5GV-58Q6

Affected Products

Mailu

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-5239 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5239 · Vendor Advisory
• https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6 · Note
• https://github.com/Mailu/Mailu/issues/1354 · Note
• https://github.com/Mailu/Mailu · Note
• https://t.me/cvenotify/983 · Telegram Post