MEDIUM
CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command
Published Jan 22, 2024
4.4
MEDIUMCVSS 3.1
EPSS 0.38%
Description
CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.
Affected products
-
- Version 7.0.8-2StatusaffectedConstraints-
- Version 7.1.1-1StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Cloudlinux OS | Cagefs | affected |
|
- < 7.1.1-1
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (4)
- http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.html ExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2024/Jan/25 ExploitMailing ListThird Party Advisory
- https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100 Release Notes
- https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands
| Link | Providers | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.html | ExploitThird Party AdvisoryVDB Entry | |
| http://seclists.org/fulldisclosure/2024/Jan/25 | ExploitMailing ListThird Party Advisory | |
| https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100 | Release Notes | |
| https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Jan 22, 2024
Updated May 30, 2025
Reserved Jan 22, 2024
Link CVE-2020-36772
CISA Vulnrichment
Updated May 9, 2025