CVE-2002-1575 cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline (%0a) characters in parameters such as "required-subject," which can be used to modify the CC, BC...
MediumCVSS 5.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline (%0a) characters in parameters such as "required-subject," which can be used to modify the CC, BCC, and other header fields in the generated email message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit cgiemail | = 1.6 | No fix listed |
References
- 20020614 Another cgiemail bug mailing-list
- 20031003 patch for vulnerability in cgiemail mailing-list
- DSA-437 patch vendor-advisory
- 5013 patch vdb-entry vendor-advisory
- cgiemail-open-mail-relay(9361) vdb-entry