Description (CNA)
The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. (Also, the message parameter can have initial HTML comment characters.)
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://www.egain.com/products/email-management-software/
- https://medium.com/maverislabs/cve-2019-17123-cbc946c99f8
ADP enrichment
No English description supplied.