Security readout for executives and security teams
Plain-English summary
This CVE affects Exim mail servers before 4.94.2. An unauthenticated SMTP client may be able to make Exim disclose sensitive data from process memory. For executives, the main concern is possible exposure of mail-server secrets or operational data on internet-facing email infrastructure.
Executive priority
Treat this as a near-term mail-infrastructure hygiene issue. It is not flagged as known exploited in the provided bundle, but unauthenticated memory disclosure on email servers can expose sensitive operational data.
Technical view
CVE-2020-28023 is an out-of-bounds read in Exim 4 before 4.94.2. The source description identifies smtp_setup_msg as the affected area and states that sensitive information from process memory may be disclosed to an unauthenticated SMTP client.
Likely exposure
Exposure is most likely where Exim versions before 4.94.2 are running as SMTP servers, especially public MX hosts. The provided affected-product metadata is incomplete, so validation should rely on actual Exim package and service inventory.
Exploitation context
The provided bundle does not identify active exploitation, and it marks KEV as false. Public details indicate unauthenticated remote information disclosure, but the sources provided do not establish exploit prevalence or operational exploitation in the wild.
Researcher notes
The evidence is concise: Exim before 4.94.2, out-of-bounds read, smtp_setup_msg, unauthenticated SMTP client, possible process-memory disclosure. No CVSS, CWE, exploit status, or vendor mitigation details beyond the fixed version are included in the bundle.
Mitigation direction
- Upgrade Exim to 4.94.2 or later where applicable.
- Check distribution vendor advisories for supported backported fixes.
- Restrict unnecessary SMTP exposure to trusted networks where business allows.
- Prioritize internet-facing mail transfer agents before internal-only systems.
Validation and detection
- Inventory all systems running Exim and record exact versions.
- Identify public MX hosts and confirm their running Exim package state.
- Check whether vendor packages include a backported fix for CVE-2020-28023.
- Review change records to confirm Exim 4.94.2 or vendor-fixed builds are deployed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-28023 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28023-SCHAD.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.