CVE-2020-5239

In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354

• CWE-863

• https://github.com/Mailu/Mailu/issues/1354Third Party Advisory
• https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6Mitigation, Third Party Advisory
• https://github.com/Mailu/Mailu/issues/1354Third Party Advisory
• https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6Mitigation, Third Party Advisory

Published

Feb 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5233OAuth2 Proxy before 5.0 has an open redirect vulnerability. …6.1
• CVE-2020-5234MessagePack for C# and Unity before version 1.9.11 and 2.1.9…6.5
• CVE-2020-5235There is a potentially exploitable out of memory condition I…9.8
• CVE-2020-5236Waitress version 1.4.2 allows a DOS attack When waitress rec…6.5
• CVE-2020-5237Multiple relative path traversal vulnerabilities in the oneu…8.8
• CVE-2020-5238The table extension in GitHub Flavored Markdown before versi…6.5
• CVE-2020-5240In wagtail-2fa before 1.4.1, any user with access to the CMS…8.5
• CVE-2020-5241matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XS…5.4
• CVE-2020-5242openHAB before 2.5.2 allow a remote attacker to use REST cal…8.8
• CVE-2020-5243uap-core before 0.7.3 is vulnerable to a denial of service a…7.5
• CVE-2020-5244In BuddyPress before 5.1.2, requests to a certain REST API e…7.5
• CVE-2020-5245Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arb…8.8