Skip to content
Sign in
Not rated

CVE-2018-1294 If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called…

Description

If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients, contents, etc.) might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You can mitigate this vulnerability for older versions of Commons Email by stripping line-breaks from data, that will be passed to Email.setBounceAddress(String).

Affected products and versions

Product Affected versions Fixed in
Apache Commons Email Versions not published

Other CVEs of Apache Commons Email

The 2 CVEs of Apache Commons Email →
CVE-2017-9801 When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the… Not rated
Track this CVE