9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.01 Low
EPSS
Percentile
83.4%
OpenDMARC releases prior to 1.4.1 are susceptible to the following
vulnerabilities:
(CVE-2019-16378) OpenDMARC through 1.3.2 and 1.4.x through
1.4.0-Beta1 is prone to a signature-bypass vulnerability with
multiple From: addresses, which might affect applications that
consider a domain name to be relevant to the origin of an e-mail
message.
(CVE-2019-20790) OpenDMARC through 1.3.2 and 1.4.x, when used
with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC
authentication in situations where the HELO field is inconsistent
with the MAIL FROM field.
(CVE-2020-12272) OpenDMARC through 1.3.2 and 1.4.x allows
attacks that inject authentication results to provide false
information about the domain that originated an e-mail
message.
(CVE-2020-12460) OpenDMARC through 1.3.2 and 1.4.x through
1.4.0-Beta1 has improper null termination in the function
opendmarc_xml_parse that can result in a one-byte heap overflow in
opendmarc_xml when parsing a specially crafted DMARC aggregate
report. This can cause remote memory corruption.
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.01 Low
EPSS
Percentile
83.4%