CVE-2020-12736
Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.03%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email, the administrator has the option to modify content for the email invitation. If the administrator entered template language code in the subject line, that code could be interpreted by the email generation services, potentially resulting in server-side code injection.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.03% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- code42/code42
- Source
- cve@mitre.org
References
- https://code42.com/r/support/CVE-2020-12736Vendor Advisory
- https://support.code42.com/Release_NotesRelease Notes, Vendor Advisory
- https://code42.com/r/support/CVE-2020-12736Vendor Advisory
- https://support.code42.com/Release_NotesRelease Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.