CVE-2020-1946CWE-78

CVE-2020-1946: vulnerability in Apache SpamAssassin

Apache SpamAssassin has an OS Command Injection vulnerability

Published · Updated

Follow this CVE+ Monitor Apache SpamAssassin+ Monitor spamassassin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 6.1%
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.
Affected products
Apache Software Foundation · Apache SpamAssassin
Related CVEs — Apache SpamAssassin

In the same product, most dangerous first.

CVE-2018-11780—CVE-2018-11780EPSS 10.8%CVE-2017-15705—CVE-2017-15705EPSS 7.9%CVE-2020-1930—CVE-2020-1930EPSS 7.1%CVE-2020-1931—CVE-2020-1931EPSS 6.5%CVE-2018-11781—CVE-2018-11781EPSS 1.0%