VULNERABILITY INTELLIGENCE

CVE-2020-36772

CVSS score4.4 MEDIUM
EPSS probability0.38%
CISA KEVNot currently listed
Published2024-01-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.

Weakness classification

  • CWE-73: External Control of File Name or Path
  • CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Primary references