PT-2019-14960 · Egain · Egain Web Email Api

Publicado 2019-12-13 · Atualizado 2021-07-21 · CVE-2019-17123

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions eGain Web Email API versions 11 and later

Description The issue allows for spoofed messages due to mishandling of the fromName and message fields in the /system/ws/v11/ss/email API endpoint. This can be demonstrated through fromName header injection using a %0a or %0d character. Additionally, the message parameter can contain initial HTML comment characters.

Recommendations For eGain Web Email API versions 11 and later, consider disabling the /system/ws/v11/ss/email API endpoint until a patch is available to prevent exploitation. Restrict access to the fromName and message fields to minimize the risk of header injection. Avoid using the fromName and message parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2019-17123

Produtos afetados

Egain Web Email Api

Referências · 6

• 🔥 https://medium.com/maverislabs/cve-2019-17123-cbc946c99f8 · Exploit
• https://t.me/canyoupwnme/6187 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-17123 · Aviso do Fabricante
• http://egain.com/products/email-management-software · Aviso do Fabricante
• https://t.me/defcon_news/32969 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-17123 · Nota de Segurança