Security readout for executives and security teams
Plain-English summary
This flaw affects Exim versions before 4.94.2. Under specific spool-file conditions, an attacker able to write a spool header file could cause Exim to execute commands with unnecessary privileges. That makes it important for organizations running Exim, but the provided sources do not show active exploitation.
Executive priority
Prioritize patch verification on mail servers because the impact is command execution with elevated privileges. Treat as urgent where Exim is exposed to untrusted local users or processes, but do not claim active exploitation from this evidence alone.
Technical view
Exim runs as root while handling a spool directory owned by a non-root user. The CVE states that writing a crafted recipient address into a /var/spool/exim4/input spool header file can indirectly lead to command execution. Affected scope is stated as Exim before 4.94.2.
Likely exposure
Likely exposure is limited to systems running Exim 4 before 4.94.2, especially where an attacker can write to Exim input spool header files. The bundle does not identify specific distributions, CPEs, or network-only attack conditions.
Exploitation context
No KEV listing is provided, and the supplied sources do not cite active exploitation. The described abuse depends on writing to a spool header file and then leveraging Exim’s privileged spool processing path.
Researcher notes
The key evidence is the privilege boundary around root spool processing and non-root spool ownership. The bundle lacks CVSS, CWE, product CPEs, and detailed distribution impact, so validation should focus on version, vendor backports, and whether spool header write access is possible.
Mitigation direction
- Upgrade Exim to 4.94.2 or a vendor-supported patched build.
- Check distribution advisories for backported fixes and package-specific guidance.
- Restrict access to accounts or services that can write Exim spool input files.
- Review Exim spool ownership and permissions for unintended write access.
Validation and detection
- Inventory Exim versions and flag any instance older than 4.94.2.
- Confirm patched package status through vendor or distribution metadata.
- Inspect /var/spool/exim4/input permissions and ownership on Linux hosts.
- Review mail-server change records for unsupported local spool modifications.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-28008 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28008-SPDIR.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.