What is the CVSS score of CVE-2020-14928?

CVE-2020-14928 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 2.8%.

Is there a public PoC exploit available for CVE-2020-14928?

Yes, a public proof-of-concept exploit is available for CVE-2020-14928. Prioritise patching immediately. EPSS: 2.8%.

Is there a patch available for CVE-2020-14928?

Yes, a patch is available for CVE-2020-14928. Update the affected software to the latest version immediately.

Evolution Data Server CVE-2020-14928

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2020-07-17 cve@mitre.org

Code Injection Evolution Data Server Debian Linux Fedora Ubuntu Linux

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Jul 17, 2020 - 16:15 nvd

MEDIUM 5.9

DescriptionNVD

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

AnalysisAI

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-74. evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection." Affected products include: Gnome Evolution-Data-Server, Debian Debian Linux, Fedoraproject Fedora, Canonical Ubuntu Linux. Version information: through 3.36.3.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.