CVE-2019-17123

HIGH

eGain Mail 11+ - Email Header Injection via fromName Parameter

Title source: llm

Description

The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. (Also, the message parameter can have initial HTML comment characters.)

References (2)

Core 2

Core References

Product, Vendor Advisory x_refsource_misc

http://www.egain.com/products/email-management-software/

Exploit, Third Party Advisory x_refsource_misc

https://medium.com/maverislabs/cve-2019-17123-cbc946c99f8

Scores

CVSS v3 7.5

EPSS 0.0098

EPSS Percentile 57.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-74

Status published

Products (1)

egain/mail 11

Published Dec 13, 2019

Tracked Since Feb 18, 2026