CVE-2020-12641

Vulnerability Profile Updated a month ago
Download STIX
Preview STIX
CVE-2020-12641 is a significant vulnerability discovered in the Roundcube Webmail application. It is an issue that arises from a flaw in the software's design or implementation, which allows for Command Injection and Cross-Site Scripting (XSS) attacks (CVE-2020-35730). The exploitation of this vulnerability can potentially lead to unauthorized access and control over the affected system. Protection against this threat is provided by Check Point IPS blade and Threat Emulation. Over a certain period, investigations by ANSSI confirmed that APT28 exploited multiple vulnerabilities, including the 0-day vulnerability in Outlook (CVE-2023-23397), and others affecting Microsoft Windows Support Diagnostic Tool (MSDT, CVE-2022-30190), also known as Follina. In addition to these, APT28 also targeted vulnerabilities in the Roundcube Webmail application, specifically CVE-2020-12641, CVE-2020-35730, and CVE-2021-44026. These exploits allowed the attackers to gain unauthorized access and control over the compromised systems. In light of these findings, organizations are advised to ensure their systems are updated with the latest patches and security configurations to mitigate the risk of these vulnerabilities. Additionally, they should employ proactive threat detection and response mechanisms, such as those offered by Check Point IPS blade and Threat Emulation, to protect against these threats. Continuous monitoring and regular audits of system logs can also help in identifying any unusual activities indicative of a potential breach.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
roundcube
Exploit
Spearphishing
Outlook
Vulnerability
Windows
Microsoft
exploited
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
APT28Targets
3
APT28, also known as Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM, is a threat actor group that has been active since 2007. This Russia-linked entity targets governments, militaries, and security organizations worldwide with malicious intent. In recent years, the group has
BluedeltaUnspecified
1
Bluedelta is a threat actor associated with the Russian state-sponsored hacking operation APT28 or Fancy Bear. In a recent spear-phishing campaign that began in November 2021, several government entities and a military aviation organization in Ukraine had their email servers targeted by Bluedelta. T
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
CVE-2020-35730Unspecified
5
CVE-2020-35730 is a Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail, first discovered three years ago. The flaw has been actively exploited by threat actors in various campaigns. In the BlueDelta and APT28 campaigns, spear-phishing techniques were employed, with email attachments desig
FollinaUnspecified
2
Follina, also known as CVE-2022-30190, is a notable software vulnerability that was discovered and exploited in the first half of 2022. This flaw, found in the Microsoft Windows Support Diagnostic Tool (MSDT), was weaponized by TA413, a cyber threat actor group with suspected ties to China. The grou
CVE-2022-30190Unspecified
1
CVE-2022-30190, also known as the "Follina" vulnerability, is a high-risk software flaw in the Microsoft Support Diagnostic Tool that allows for remote code execution. This 0-day vulnerability was disclosed in May 2022 and has since been exploited by threat actors, including TA413, who weaponized it
CVE-2021-44026Unspecified
1
None
Source Document References
Information about the CVE-2020-12641 Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
8 months ago
How APT28 Infiltrates Networks in French Universities & Nuclear Plants Without Detection
Securityaffairs
a year ago
CISA adds recently disclosed Apple flaws to its Known Exploited Vulnerabilities catalog
CERT-EU
a year ago
Several bugs added to CISA vulnerability catalog
Recorded Future
a year ago
BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities | Recorded Future
CERT-EU
7 months ago
Advanced threat predictions for 2024 – GIXtools
CERT-EU
8 months ago
Several French critical networks subjected to Russian APT attacks
Securityaffairs
a year ago
APT28 hacked Roundcube email servers of Ukrainian entities
Checkpoint
a year ago
3rd July – Threat Intelligence Report - Check Point Research
CERT-EU
a year ago
Russia’s APT28 breached Ukrainian orgs via RoundCube flaws
BankInfoSecurity
a year ago
Ukraine Tracks Multiple Spear-Phishing Campaigns From Russia
Securityaffairs
a month ago
NATO and the EU formally condemned APT28 cyber espionage
CERT-EU
a year ago
CISA Tells US Agencies to Patch Exploited Roundcube, VMware Flaws
CERT-EU
a year ago
Ex-FBI employee jailed for mishandling classified material
CERT-EU
a year ago
Governmental Agencies Ordered by CISA to Patch Vulnerabilities Exploited by Russian APT Groups
CERT-EU
a year ago
Russian hackers breach Ukrainian government and military entities
CERT-EU
a year ago
CISA Adds Six Known Exploited Vulnerabilities to Catalog | CISA
Securityaffairs
8 months ago
ANSSI warns of Russia-linked APT28 attacks on French entities
Securelist
7 months ago
Kaspersky Security Bulletin: APT predictions 2024
CERT-EU
a year ago
Microsoft warns of rise in credential stealing attacks by Russia-linked group
CERT-EU
a year ago
Cyber security week in review: June 23, 2023