CVE-2020-36772

2024-01-2214:11:25

CWE-73

redhat

www.cve.org

cloudlinux

cagefs

security bypass

file restriction

AI Score

4.7

Confidence

High

EPSS

Percentile

5.1%

JSON

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "cagefs",
    "vendor": "Cloudlinux OS",
    "versions": [
      {
        "status": "affected",
        "version": "7.0.8-2"
      },
      {
        "status": "unaffected",
        "version": "7.1.1-1"
      }
    ]
  }
]