high7.5
CVE-2016-4803
CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequence…
Impact
CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dotcms | Dotcms | through 3.3.1 |
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2016/May/69
- http://www.securityfocus.com/bid/91529
- https://dotcms.com/docs/latest/change-log#release-3.3.2
- https://security.elarlang.eu/cve-2016-4803-dotcms-email-header-injection-vulnerability-full-disclosure.html
- http://seclists.org/fulldisclosure/2016/May/69
- http://www.securityfocus.com/bid/91529
- https://dotcms.com/docs/latest/change-log#release-3.3.2
- https://security.elarlang.eu/cve-2016-4803-dotcms-email-header-injection-vulnerability-full-disclosure.html