CVE-2020-15955

Katalog CVE

CVSS 5.9 · Medium EPSS 0,95%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada fehcom s/qmail. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This allows e-mail messages and user credentials to be sent to the MitM attacker.

Rincian

Terbit di NVD

17 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.fehcom.de/sqmail/sqmail.html patch · release notes · advisory vendor
• https://nostarttls.secvuln.info/ deskripsi teknis · advisory pihak ketiga