CVE-2020-12736 Code injection in n/a
Administrators can inject server-side code via email templates, leading to remote code execution on Code42 on-premises servers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12736?
CVE-2020-12736 is a high-severity code injection vulnerability in n/a, published on 7 Jul 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email, the administrator has the option to modify content for the email invitation. If the administrator entered template language code in the subject line, that code could be interpreted by the email generation services, potentially resulting in server-side code injection.
Weakness: CWE-74
Which versions are affected by CVE-2020-12736?
It affects 1 product.
Products include Code42 Code42.
How do I fix CVE-2020-12736?
No fix has been published for CVE-2020-12736 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-12736 being exploited?
There is no known exploitation of CVE-2020-12736 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-c3g2-jch4-vfp3.