CVEvulnerability

CVE-2009-1469

4.3 MEDIUM Published 2009-05-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-05-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-94

Description

CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element of an XML document, as demonstrated by triggering an e-mail message from the server that contains a user's correct credentials, and requests that the user compose a reply that includes this message.

Affected configurations

• icewarp email server (<= 9.3.0) • icewarp email server 2.10.105 • icewarp email server 2.10.110 • icewarp email server 2.10.115 • icewarp email server 2.10.140 • icewarp email server 2.10.150 • icewarp email server 2.10.165 • icewarp email server 2.10.170 • icewarp email server 2.10.190 • icewarp email server 2.10.200 • icewarp email server 2.10.210 • icewarp email server 2.10.220 • icewarp email server 2.10.240 • icewarp email server 2.10.250 • icewarp email server 2.10.260 • icewarp email server 2.10.280 • icewarp email server 2.10.290 • icewarp email server 2.10.310 • icewarp email server 2.10.320 • icewarp email server 2.10.330 • icewarp email server 2.10.331 • icewarp email server 2.10.340 • icewarp email server 2.10.350 • icewarp email server 2.10.360 • icewarp email server 3.00.100 • icewarp email server 3.00.110 • icewarp email server 3.00.120 • icewarp email server 3.00.130 • icewarp email server 3.00.140 • icewarp email server 3.10.011 • icewarp email server 3.10.110 • icewarp email server 4.00.30 • icewarp email server 4.2.1 • icewarp email server 4.2.2 • icewarp email server 4.2.3 • icewarp email server 4.4.1 • icewarp email server 4.4.2 • icewarp email server 4.10.040 • icewarp email server 4.10.050 • icewarp email server 5.1.2 • icewarp email server 5.1.3 • icewarp email server 5.1.5 • icewarp email server 5.3.0 • icewarp email server 5.3.2 • icewarp email server 5.4.1 • icewarp email server 5.4.2 • icewarp email server 5.4.3 • icewarp email server 5.4.4 • icewarp email server 5.5.3 • icewarp email server 5.5.4 • icewarp email server 5.5.5 • icewarp email server 5.5.6 • icewarp email server 5.5.7 • icewarp email server 5.7.3 • icewarp email server 5.8.2 • icewarp email server 5.8.3 • icewarp email server 5.8.4 • icewarp email server 5.8.5 • icewarp email server 5.8.6 • icewarp email server 5.9.4 … and 116 more

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References