CVE-2020-1931

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
Apache Software FoundationApache SpamAssassinprior to 3.4.3

References

Timeline

Published
Jan 30, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-193168.8OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.CVE-2020-193188.8Buffer Overflow vulnerability in D-Link DIR-605L, hardware version AX, firmware version 1.17beta and below, allows authorized attackers execCVE-2020-193199.8Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the FILECODE parameter on login.CVE-2020-19326.5An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are ablCVE-2020-193209.8Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the curTime parameter on login.CVE-2020-193237.5An issue was discovered in /bin/mini_upnpd on D-Link DIR-619L 2.06beta devices. There is a heap buffer overflow allowing remote attackers toCVE-2020-19336.1A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware autCVE-2020-19345.3In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.CVE-2020-19354.8In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsinCVE-2020-19366.1A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.CVE-2020-193607.5Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead toCVE-2020-193616.1Reflected XSS in Medintux v2.16.000 CCAM.php by manipulating the mot1 parameter can result in an attacker performing malicious actions to us