CVE-2020-36519

Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rewrite feature. (The domain being spoofed must be a customer in the Mimecast grid from which the spoofing occurs.)

CVSS v3.1

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

0.81% chance of exploitation in the next 30 days, 55th percentile

Published

2022-03-15

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://wesleyk.me/2020/01/10/my-first-vulnerability-mimecast-sender-address-verification/

References

• CVE Record
• NVD entry

Related

• CVE-2020-36518
• CVE-2020-36523
• CVE-2020-36510
• CVE-2020-36524
• CVE-2020-36505
• CVE-2020-36525