CVE-2020-12714

Vulnerability

CVE-2020-12714 affects CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0, as well as CipherMail Webmail Messenger Virtual Appliances versions 1.1.1 through 3.1.1-0. The vulnerability stems from the use of Diffie-Hellman parameters of insufficient size in the TLS configuration for SMTP connections. This weak cryptographic setup allows an attacker to compromise the confidentiality and integrity of email traffic between CipherMail products and external SMTP clients [4].

Exploitation

An attacker must be in a position to intercept network traffic between a CipherMail gateway or webmail appliance and an external SMTP server (man-in-the-middle position). No authentication is required; the attacker can exploit the weak Diffie-Hellman parameters to perform a cryptographic downgrade or compute the shared secret, thereby decrypting and potentially modifying the SMTP session in transit [4].

Impact

Successful exploitation results in a man-in-the-middle compromise of communications. The attacker can read, modify, or inject email messages exchanged between the CipherMail product and external SMTP clients. This leads to a loss of confidentiality and integrity of email data, potentially exposing sensitive information or enabling further attacks [4].

Mitigation

CipherMail has resolved this issue in a subsequent release. Users should upgrade to the latest version of their respective product (Community Gateway, Professional/Enterprise Gateway, or Webmail Messenger) as recommended by the vendor. No workaround is documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date [4].