CVE-2020-11852

DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command.

CVSS v3 8.8 HIGH
CVSS v2.0 9.0 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://support.microfocus.com/kb/doc.php?id=7024775

Configurations

Configuration 1 (hide)

cpe:2.3:a:microfocus:secure_messaging_gateway:*:*:*:*:*:*:*:*

History

07 Nov 2023, 03:15

Type	Values Removed	Values Added
CWE	~~CWE-74~~	CWE-78
References	~~(MISC) https://support.microfocus.com/kb/doc.php?id=7024775 - Vendor Advisory~~	() https://support.microfocus.com/kb/doc.php?id=7024775 -

Information

Published : 2020-08-07 16:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-11852

Mitre link : CVE-2020-11852

CVE.ORG link : CVE-2020-11852

JSON object : View

Products Affected

microfocus

secure_messaging_gateway

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2020-11852", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2020-08-07T16:15:11.700", "references": [{"url": "https://support.microfocus.com/kb/doc.php?id=7024775", "source": "security@opentext.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command."}, {"lang": "es", "value": "Vulnerabilidad de la p\u00e1gina de administraci\u00f3n de claves DKIM en Micro Focus Secure Messaging Gateway (SMG). Afectando a todas las versiones en ejecuci\u00f3n del dispositivo SMG versiones anteriores a julio de 2020. La vulnerabilidad podr\u00eda permitir a un usuario que haya iniciado sesi\u00f3n con derechos para generar informaci\u00f3n de la clave DKIM inyectar comandos del sistema en la llamada al comando del sistema DKIM"}], "lastModified": "2023-11-07T03:15:12.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microfocus:secure_messaging_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35074F77-D5C0-48B4-BC5A-FD6930AB8975", "versionEndExcluding": "2020-07-01"}], "operator": "OR"}]}], "sourceIdentifier": "security@opentext.com"}