Описание
The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. (Also, the message parameter can have initial HTML comment characters.)
Ссылки
- ProductVendor Advisory
- ExploitThird Party Advisory
- ProductVendor Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 11 (включая)
cpe:2.3:a:egain:mail:*:*:*:*:*:*:*:*
EPSS
Процентиль: 63%
0.00441
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-74
Связанные уязвимости
CVSS3: 7.5
github
больше 3 лет назад
The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. (Also, the message parameter can have initial HTML comment characters.)
EPSS
Процентиль: 63%
0.00441
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-74