LiveActive security incident?Get immediate response
CVE Record

CVE-2020-27509: Persistent XSS in Galaxkey Secure Mail Client in Galaxkey up to 5.6.11.5 allows an attacker to perform an a...

Persistent XSS in Galaxkey Secure Mail Client in Galaxkey up to 5.6.11.5 allows an attacker to perform an account takeover by intercepting the HTTP Post request when sending an email and injecting a specially crafted XSS payload in the 'subject' field. The payload executes when the recipient logs into their mailbox.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This CVE describes stored cross-site scripting in Galaxkey Secure Mail Client. A malicious email subject could execute script when a recipient opens their mailbox, with the reported impact of account takeover. The source bundle does not include CVSS, vendor advisory, or confirmed fix details.

Executive priority

Treat as a high-priority exposure check if Galaxkey handles sensitive mail or user authentication. Account takeover impact is serious, but urgency depends on whether affected versions remain deployed and whether vendor remediation exists.

Technical view

The reported flaw affects Galaxkey up to 5.6.11.5. The vulnerable data path is the email subject field during sending and later mailbox rendering. The source claims persistent XSS can execute in the recipient context and enable account takeover, but product metadata and remediation details are incomplete.

Likely exposure

Exposure is likely limited to organizations running Galaxkey Secure Mail Client or Galaxkey deployments at version 5.6.11.5 or earlier. The CVE record’s affected-product fields are not populated, so confirm exact product and version mapping with Galaxkey.

Exploitation context

The bundle contains a public researcher write-up but no KEV listing and no cited evidence of active exploitation. The described attack requires crafted content reaching the subject rendering path and executing when the recipient logs into their mailbox.

Researcher notes

The source bundle is thin: no CVSS vector, CWE, populated CPEs, vendor advisory, or patch reference. The Medium article is the primary technical source. Avoid assuming affected builds beyond the stated Galaxkey up to 5.6.11.5.

Mitigation direction

  • Check Galaxkey vendor guidance for fixed versions or supported mitigations.
  • Upgrade or retire Galaxkey versions confirmed by vendor as affected.
  • Restrict access to the Galaxkey mailbox interface where operationally possible.
  • Monitor mailbox and account activity for suspicious changes after message viewing.

Validation and detection

  • Inventory Galaxkey deployments and record exact product versions.
  • Confirm whether any deployment is version 5.6.11.5 or earlier.
  • Review mail logs for unusual subject content and related account changes.
  • Validate subject rendering behavior only in an authorized safe test environment.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-27509 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.