CVE-2020-8793

OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.

CVSS v3.1

4.7 MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.7 MEDIUMAV:L/AC:M/Au:N/C:C/I:N/A:N

EPSS

0.90% chance of exploitation in the next 30 days, 57th percentile

Published

2020-02-25

Updated

2024-08-04

Proof-of-concept exploits (3)

• http://www.openwall.com/lists/oss-security/2020/02/24/4
• DmitrijVC/OpenSMTPD-RS0★ · 2020-11-30
• FssAy/OpenSMTPD-RS0★ · 2020-11-30

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/48139

References

• CVE Record
• NVD entry

Related

• CVE-2020-8789
• CVE-2020-8794
• CVE-2020-8788
• CVE-2020-8804
• CVE-2020-8778
• CVE-2020-8811