CVE-2020-28014 — Improper Privilege Management in Exim

CWE-269 — Improper Privilege Management9 documents7 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 62.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Exim
Timeline
PublishedMay 6
Latest updateMay 24

Description

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:HExploitability: 1.8 | Impact: 4.2

Affected Packages1 packages

▶NVDexim/exim4.00 — 4.94.2

🔴Vulnerability Details

3
GHSA
GHSA-8rq7-g7j7-m3rf: Exim 4 before 4↗2022-05-24
▶
CVEList
CVE-2020-28014: Exim 4 before 4↗2021-05-06
▶
OSV
CVE-2020-28014: Exim 4 before 4↗2021-05-06
▶

📋Vendor Advisories

3
Ubuntu
Exim vulnerabilities↗2021-05-06
▶
Ubuntu
Exim vulnerabilities↗2021-05-04
▶
Debian
CVE-2020-28014: exim4 - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP optio...↗2020
▶

🕵️Threat Intelligence

2
Qualys
21Nails: Multiple Critical Vulnerabilities in Exim Mail Server↗2021-05-04
▶
Qualys
21Nails: Multiple Critical Vulnerabilities in Exim Mail Server | Qualys↗2021-05-04
▶