{"cve":"CVE-2020-5239","nvd":{"published":"2020-02-13T01:15:11.047","modified":"2026-06-17T03:21:06.560","status":"Modified","description":"In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-863"],"references":["https://github.com/Mailu/Mailu/issues/1354","https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6","https://github.com/Mailu/Mailu/issues/1354","https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"],"products":["mailu:mailu"],"source":"nvd","synced_at":"2026-10-19T21:02:53.949909883+00:00"},"epss":{"cve":"CVE-2020-5239","score":0.0089,"percentile":0.59382,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}