The target is running at least one instance of Simple Form which fails to remove newlines from variables used to construct message headers. A remote attacker can exploit this flaw to add to the list of recipients, enabling him to use Simple Form on the target as a proxy for sending abusive mail or spam.

Upgrade to Simple Form 2.3 or later.

• http://worldcommunity.com/opensource/utilities/simple_form.html

---

Updated on 2015-03-25