CVE-2020-12272

OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.

Weakness

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Affected Software

Name	Vendor	Start Version	End Version
Opendmarc	Trusteddomain	1.0.0 (including)	1.3.2 (including)
Opendmarc	Trusteddomain	1.4.0 (including)	1.4.0 (including)
Opendmarc	Trusteddomain	1.4.0-beta0 (including)	1.4.0-beta0 (including)
Opendmarc	Trusteddomain	1.4.0-beta1 (including)	1.4.0-beta1 (including)
Opendmarc	Ubuntu	bionic	*
Opendmarc	Ubuntu	eoan	*
Opendmarc	Ubuntu	esm-apps/bionic	*
Opendmarc	Ubuntu	esm-apps/focal	*
Opendmarc	Ubuntu	esm-apps/xenial	*
Opendmarc	Ubuntu	focal	*
Opendmarc	Ubuntu	groovy	*
Opendmarc	Ubuntu	hirsute	*
Opendmarc	Ubuntu	impish	*
Opendmarc	Ubuntu	kinetic	*
Opendmarc	Ubuntu	trusty	*
Opendmarc	Ubuntu	upstream	*
Opendmarc	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2020-12272
CWE	https://cwe.mitre.org/data/definitions/290.html

Authentication Bypass by Spoofing

Weakness

Affected Software

References

CVE-2020-12272

Authentication Bypass by Spoofing

Weakness

Affected Software

Related Attack Patterns

References