Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email, the administrator has the option to modify content for the email invitation. If the administrator entered template language code in the subject line, that code could be interpreted by the email generation services, potentially resulting in server-side code injection.
Metrics
Affected Vendors & Products
References
History
No history.

Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2024-08-04T12:04:22.576Z
Reserved: 2020-05-08T00:00:00
Link: CVE-2020-12736

No data.

Status : Modified
Published: 2020-07-07T20:15:09.947
Modified: 2024-11-21T05:00:10.393
Link: CVE-2020-12736

No data.