PT-2002-2493 · Matt Wright · Matt Wright Formmail

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1771

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Matt Wright FormMail versions 1.9 and earlier

Description The issue allows remote attackers to send spam or anonymous e-mail by injecting a newline character followed by CC:, BCC:, or additional TO: fields in the email and realname CGI variables.

Recommendations For Matt Wright FormMail versions 1.9 and earlier, consider validating and sanitizing user input for the email and realname variables to prevent injection of malicious characters and fields. As a temporary workaround, restrict access to the email sending functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-1771

Affected Products

Matt Wright Formmail

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2002-1771 · Security Note
• http://securityfocus.com/bid/3955 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1771 · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-01/0307.html · Note
• http://scriptarchive.com/readme/formmail.html#history · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8013 · Note