CVE-2018-1294

EPSS 2.9%

Vexday Risk Score

3Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS —EPSS 2.9%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

20 mar 2018Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients, contents, etc.) might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You can mitigate this vulnerability for older versions of Commons Email by stripping line-breaks from data, that will be passed to Email.setBounceAddress(String).

Productos afectados

Apache Software Foundation · Apache Commons Email

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

http://seclists.org/oss-sec/2018/q1/107