CVE-2020-8793
MEDIUM 4.7EPSS 0.9%
OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.
- CVSS v3.1 NVD
- 4.7 MEDIUM
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS v2.0 NVD
- 4.7 MEDIUM
AV:L/AC:M/Au:N/C:C/I:N/A:N - EPSS
- 0.90% chance of exploitation in the next 30 days, 59th percentile
- Published
- 2020-02-25
- Updated
- 2024-08-04
Proof-of-concept exploits (3)
- http://www.openwall.com/lists/oss-security/2020/02/24/4
- DmitrijVC/OpenSMTPD-RS0★ · 2020-11-30
- FssAy/OpenSMTPD-RS0★ · 2020-11-30
ExploitDB entries (1)
Security advisories
- http://seclists.org/fulldisclosure/2020/Feb/28
- https://usn.ubuntu.com/4294-1
- https://www.openbsd.org/security.html