CVE-2020-36772

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-36772
CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.

4.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2024/Jan/25 Exploit Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jan/25 Exploit Mailing List Third Party Advisory
https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100 Release Notes
https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100 Release Notes
https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands
https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands
Configurations

Configuration 1 (hide)

cpe:2.3:a:cloudlinux:cagefs:*:*:*:*:*:*:*:*
History

28 Mar 2024, 19:15

Type Values Removed Values Added
References
  • () https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands -
Summary CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files outside the CageFS environment in a limited way. CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.

29 Jan 2024, 17:32

Type Values Removed Values Added
CPE cpe:2.3:a:cloudlinux:cagefs:*:*:*:*:*:*:*:*
CWE CWE-610
First Time Cloudlinux cagefs
Cloudlinux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.4
References () http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.html - () http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.html - Exploit, Third Party Advisory, VDB Entry
References () https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100 - () https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100 - Release Notes
References () http://seclists.org/fulldisclosure/2024/Jan/25 - () http://seclists.org/fulldisclosure/2024/Jan/25 - Exploit, Mailing List, Third Party Advisory

26 Jan 2024, 17:15

Type Values Removed Values Added
References
  • () http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.html -

26 Jan 2024, 16:15

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2024/Jan/25 -

22 Jan 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-22 15:15

Updated : 2025-05-30 15:15

NVD link : CVE-2020-36772

Mitre link : CVE-2020-36772

JSON object : View

Products Affected

cloudlinux

  • cagefs
CWE
CWE-610

Externally Controlled Reference to a Resource in Another Sphere