CVE-2020-12618
Medium
Description
eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the attacker to decipher further communication. The entire attack could be accomplished by sending a single email.
SeverityMedium
CVSS4.8
Exploit probability—
ProductEmclient Em Client
PublishedAug 20, 2020
First seenAug 20, 2020
How to fix
Update
- emclient em_client7.2.33412.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emclient em_client | v < 7.2.33412.0 | 7.2.33412.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.