CVE-2019-17123

The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by…

published December 13, 2019

CVSS
—
EPSS
1%
Percentile
62.0
In the wild
Unconfirmed
What it is

The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. (Also, the message parameter can have initial HTML comment characters.)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00984 · 62.0th percentile
Published
2019-12-13T17:54Z
EPSS history
Timeline
  • 13 DEC 17:54Z
    The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by…
    cvelistv5