CVE-2020-14954

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

2.29% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 81.7% of scored records. A rank, not a probability.

NVD base score

5.9 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2020-06-21 16:55Z6 YR AGO

Last updated

2024-08-04 13:00Z2 YR AGO

Reserved

2020-06-21

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Class
• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')Class

Data version

5.1

Document digest

57b6fa076cc9bf6820aaa701d8c46bf9386d2de5cf91e109d26805baf5e0643d

• www.debian.orgDSA-4707https://www.debian.org/security/2020/dsa-4707vendor-advisoryx_refsource_DEBIAN
• www.mutt.orghttp://www.mutt.org/x_refsource_MISC
• gitlab.comhttps://gitlab.com/muttmua/mutt/-/issues/248x_refsource_MISC
• lists.mutt.orghttp://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200615/000023.htmlx_refsource_MISC
• gitlab.comhttps://gitlab.com/muttmua/mutt/-/commit/c547433cdf2e79191b15c6932c57f1472bfb5ff4x_refsource_MISC
• github.comhttps://github.com/neomutt/neomutt/releases/tag/20200619x_refsource_MISC
• github.comhttps://github.com/neomutt/neomutt/commit/fb013ec666759cb8a9e294347c7b4c1f597639ccx_refsource_MISC
• www.debian.orgDSA-4708https://www.debian.org/security/2020/dsa-4708vendor-advisoryx_refsource_DEBIAN
• lists.opensuse.orgopenSUSE-SU-2020:0903http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgopenSUSE-SU-2020:0915http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.htmlvendor-advisoryx_refsource_SUSE
• lists.debian.org[debian-lts-announce] 20200630 [SECURITY] [DLA 2268-1] mutt security updatehttps://lists.debian.org/debian-lts-announce/2020/06/msg00039.htmlmailing-listx_refsource_MLIST
• lists.debian.org[debian-lts-announce] 20200630 [SECURITY] [DLA 2268-2] mutt regression updatehttps://lists.debian.org/debian-lts-announce/2020/06/msg00040.htmlmailing-listx_refsource_MLIST
• lists.fedoraproject.orgFEDORA-2020-1cb4c3697bhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3LXFVPTLK4PNHL6MPKJNJQJ25CH7GLQ/vendor-advisoryx_refsource_FEDORA
• usn.ubuntu.comUSN-4403-1https://usn.ubuntu.com/4403-1/vendor-advisoryx_refsource_UBUNTU
• lists.fedoraproject.orgFEDORA-2020-31af2ac7fdhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFMEILCBKMZRRZDMUGWLVN4PQQ4VTAZE/vendor-advisoryx_refsource_FEDORA
• security.gentoo.orgGLSA-202007-57https://security.gentoo.org/glsa/202007-57vendor-advisoryx_refsource_GENTOO