CVE-2020-12776

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Openfind	Mail2000	<= 7.0

References

https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.htmlThird Party Advisory

Timeline

Published: Sep 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-127777.5A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and discl CVE-2020-127786.1Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.CVE-2020-127795.4Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.CVE-2020-12787.8An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'CVE-2020-127807.5A security misconfiguration exists in Combodo iTop, which can expose sensitive information.CVE-2020-127818.8Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request CVE-2020-127829.8Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment will CVE-2020-127837.5Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and CVE-2020-127845.3cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).CVE-2020-127858.1cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).CVE-2020-127877.5Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.CVE-2020-127887.5CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.