CVE-2020-12272 : OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication resu

OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.

Published 2020-04-27 14:15:11

Updated 2023-08-28 20:15:08

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-12272

Fedoraproject » Fedora » Version: 33
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Matching versions
Trusteddomain » Opendmarc
Versions from including (>=) 1.0.0 and up to, including, (<=) 1.3.2
cpe:2.3:a:trusteddomain:opendmarc:*:*:*:*:*:*:*:*
Matching versions
Trusteddomain » Opendmarc » Version: 1.4.0 Update Beta1
cpe:2.3:a:trusteddomain:opendmarc:1.4.0:beta1:*:*:*:*:*:*
Matching versions
Trusteddomain » Opendmarc » Version: 1.4.0
cpe:2.3:a:trusteddomain:opendmarc:1.4.0:-:*:*:*:*:*:*
Matching versions
Trusteddomain » Opendmarc » Version: 1.4.0 Update Beta0
cpe:2.3:a:trusteddomain:opendmarc:1.4.0:beta0:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-12272

EPSS FAQ

0.93%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 74 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-12272

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2020-12272

CWE-290 Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-12272

https://sourceforge.net/p/opendmarc/tickets/237/

opendmarc / Tickets / #237 Security Bugs: authentication results injections attacks affecting OpenDMARC that can bypass DMARC authentication
Exploit;Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00035.html

[SECURITY] [DLA 3546-1] opendmarc security update
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D4JGHMALEJEWWG56DKR5OZB22TK7W5B/

[SECURITY] Fedora 33 Update: opendmarc-1.4.1-1.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf

Technical Description;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KBOGOQOK3TIWWJV66MW5YWNRJAFFYGR5/

[SECURITY] Fedora 34 Update: opendmarc-1.4.1-1.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-12272

Products affected by CVE-2020-12272

Exploit prediction scoring system (EPSS) score for CVE-2020-12272

CVSS scores for CVE-2020-12272

CWE ids for CVE-2020-12272

References for CVE-2020-12272