CVE-2018-1294

State: Published
Severity: Not scored
Published: Mar 20, 2018
Updated: Sep 16, 2024
Reserved: Dec 7, 2017

Description

If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients, contents, etc.) might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You can mitigate this vulnerability for older versions of Commons Email by stripping line-breaks from data, that will be passed to Email.setBounceAddress(String).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Apache Commons EmailApache Software Foundation	versions prior to 1.5Affected

References

[oss-security] 20180126 CVE-2018-1294: Apache Commons Email vulnerability information disclosuremailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.