CVE-2020-13376 File upload in n/a
Attackers can upload executable files via a crafted cookie to achieve OS command execution on SecurEnvoy SecurMail servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-13376?
CVE-2020-13376 is a critical vulnerability in n/a, published on 7 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie.
Weakness: CWE-22
Which versions are affected by CVE-2020-13376?
It affects 1 product.
Products include Securenvoy Securmail.
How do I fix CVE-2020-13376?
No fix has been published for CVE-2020-13376 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-13376 being exploited?
There is no known exploitation of CVE-2020-13376 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-7702 Missing authorization in n/a
- CVE-2018-7705 Path traversal in n/a
- CVE-2018-7701 Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authe
- CVE-2018-7704 Information disclosure in n/a
- CVE-2018-7706 Path traversal in n/a
Sources
Also known as GHSA-33rv-x9gp-7cfh.