PT-2002-2493 · Matt Wright · Matt Wright Formmail

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1771

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Matt Wright FormMail versions 1.9 and earlier

Description The issue allows remote attackers to send spam or anonymous e-mail by injecting a newline character followed by CC:, BCC:, or additional TO: fields in the email and realname CGI variables.

Recommendations For Matt Wright FormMail versions 1.9 and earlier, consider validating and sanitizing user input for the email and realname variables to prevent injection of malicious characters and fields. As a temporary workaround, restrict access to the email sending functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-1771

Produtos afetados

Matt Wright Formmail

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1771 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2002-01/0307.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1771 · Nota de Segurança
• http://scriptarchive.com/readme/formmail.html#history · Nota
• http://securityfocus.com/bid/3955 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8013 · Nota