Description

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.

Remediation

References

http://www.securityfocus.com/bid/100082

http://www.securitytracker.com/id/1039043

https://lists.apache.org/thread.html/7ef903a772a2ff08605df1be819044fb15df2815eb3d63878b3fbbb5%40%3Cannounce.apache.org%3E

Related Vulnerabilities

CVE-2023-36479 Vulnerability in maven package org.eclipse.jetty.ee8:jetty-ee8-servlets

CVE-2014-0120 Vulnerability in maven package io.hawt:hawtio-system

CVE-2016-1000232 Vulnerability in npm package tough-cookie

CVE-2018-10936 Vulnerability in maven package org.postgresql:postgresql

CVE-2022-39225 Vulnerability in npm package parse-server

Severity

High

Classification

CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Third Party Advisory VDB Entry