CVE-2020-12776 Openfind Mail2000 - Broken Access Control

What is CVE-2020-12776?

CVE-2020-12776 is a medium-severity missing authorization vulnerability in Openfind Mail2000, published on 1 Sep 2020. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie.

Which versions are affected by CVE-2020-12776?

It affects 1 product.

Products include Openfind Mail2000.

How do I fix CVE-2020-12776?

No fix has been published for CVE-2020-12776 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-12776 being exploited?

There is no known exploitation of CVE-2020-12776 in the wild and no public exploit code.

Other vulnerabilities in Openfind Mail2000

• CVE-2024-5400 Openfind Mail2000 - OS Command Injection High 8.8
• CVE-2024-5399 Openfind Mail2000 - OS Command Injection High 7.2
• CVE-2024-6740 Openfind Mail2000 - Stored XSS Medium 6.1
• CVE-2019-15071 Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting Medium 6.1
• CVE-2019-15072 Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-chfx-f86m-4vj9.