VulnerabilityModified
CVE-2007-4612
CRLF injection vulnerability in contact.php in Moonware (aka Dale Mooney Gallery) allows remote attackers to add arbitrary mail headers via CRLF sequences in the subject parameter.
MEDIUM 4.3EPSS 1.07%
Does this matter?
Lower severity and a low EPSS score (1.07%). Track it; it rarely justifies an emergency change on its own.
Description
CRLF injection vulnerability in contact.php in Moonware (aka Dale Mooney Gallery) allows remote attackers to add arbitrary mail headers via CRLF sequences in the subject parameter. NOTE: this can be leveraged for spam by adding To or Cc headers.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 1.07% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- dale mooney/contact form
- Source
- cve@mitre.org
References
- http://securityreason.com/securityalert/3079
- http://www.securityfocus.com/archive/1/477851/100/0/threaded
- http://www.securityfocus.com/bid/25457
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36290
- http://securityreason.com/securityalert/3079
- http://www.securityfocus.com/archive/1/477851/100/0/threaded
- http://www.securityfocus.com/bid/25457
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36290
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.