CVE-2020-36772

Published: Jan 22, 2024

Modified: May 30, 2025

PUBLISHED

Description

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.

Vendor	Product	Versions
Cloudlinux OS	cagefs	affected `7.0.8-2` unaffected `7.1.1-1`

Weaknesses (CWE)

CWE-73

References

https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100

http://seclists.org/fulldisclosure/2024/Jan/25

http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.html

https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2020-36772

Description

Affected Products

Weaknesses (CWE)

References