CVE-2020-11852 Command injection in Secure Messaging Gateway ( SMG).
Authenticated users with DKIM generation rights can inject system commands into the DKIM key management page, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11852?
CVE-2020-11852 is a high-severity command injection vulnerability in Secure Messaging Gateway ( SMG)., published on 7 Aug 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command.
Weakness: CWE-78
Which versions are affected by CVE-2020-11852?
It affects 1 product.
Products include Microfocus Secure Messaging Gateway.
How do I fix CVE-2020-11852?
No fix has been published for CVE-2020-11852 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-11852 being exploited?
There is no known exploitation of CVE-2020-11852 in the wild and no public exploit code.
Other vulnerabilities in Secure Messaging Gateway ( SMG).
Sources
Also known as GHSA-mwwm-6m8g-p8pv.