High severity · published Aug 7, 2020
CVE-2020-11852
DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG)
8.8
CVSS
1.4%
EPSS
No
On KEV
Description
DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Secure Messaging Gateway · Microfocus
before 2020-07-01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11852
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11852
support.microfocus.com
https://support.microfocus.com/kb/doc.php?id=7024775
More from Secure Messaging Gateway
9.8
CVE-2018-12464
A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute…
7.2
CVE-2018-12465
An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user…