Improper input validation in Commons Email - CVE-2017-9801
Published: August 2, 2017
Vulnerability identifier: #VU7654
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-9801
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject arbitrary files.
The weakness exists due to improper input validation flaw in the setSubject() method. A remote attacker can supply a specially crafted value containing line break characters, inject SMTP headers and perform further attack.
The weakness exists due to improper input validation flaw in the setSubject() method. A remote attacker can supply a specially crafted value containing line break characters, inject SMTP headers and perform further attack.
Affected software
Commons Email
Liferay Enterprise Portal
IBM Qradar SIEM
Liferay Enterprise Portal
IBM Qradar SIEM
How to mitigate CVE-2017-9801
Update to version 1.5.
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 12, 7.4.3 Fix Pack 6, 7.5.0 Update Pack 2