CVE-2020-12736 - CVE House
Back to Database
Status published High CVE-2020-12736

Code42 environments with on-premises server versions 7.0.4 and earlier allow...

Vulnerability Description

Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email, the administrator has the option to modify content for the email invitation. If the administrator entered template language code in the subject line, that code could be interpreted by the email generation services, potentially resulting in server-side code injection.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-12736

Credits & Attribution

No credits recorded in the NVD database.

References

More from code42

View All →
CVE-2021-43269
In Code42 app before 8.8.0, eval injection allows an attacker...
High 8.8
CVE-2019-16861
Code42 server through 7.0.2 for Windows has an Untrusted Search...
High 7.3
CVE-2019-16860
Code42 app through version 7.0.2 for Windows has an Untrusted...
High 7.3
CVE-2019-15131
In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and...
Critical 9.8
CVE-2019-11553
In Code42 for Enterprise through 6.8.4, an administrator without web...
High 8.8

Affected Vendor

Affected Software

code42
Vulnerable Versions:
0

Timeline

Official Publish: July 7th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.