CVEvulnerability

CVE-2006-5262

6.5 MEDIUM Published 2006-10-12 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-10-12
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P

Description

CRLF injection vulnerability in lib/session.php in Hastymail 1.5 and earlier before 20061008 allows remote authenticated users to send arbitrary IMAP commands via a CRLF sequence in a mailbox name. NOTE: the attack crosses privilege boundaries if the IMAP server configuration prevents a user from establishing a direct IMAP session.

Affected configurations

• hastymail hastymail (<= 1.5) • hastymail hastymail 1.0.1 • hastymail hastymail 1.0.2 • hastymail hastymail 1.1 • hastymail hastymail 1.2

References