CVE-2009-1469 describes a CRLF injection vulnerability in the "Forgot Password" feature of IceWarp eMail Server and WebMail Server versions prior to 9.4.2. This flaw allows remote attackers to manipulate email headers, specifically the Reply-To field, by injecting CRLF sequences into the subject of an XML document. The vulnerability has a CVSS score of 4.3, indicating a medium severity, as it requires medium attack complexity and could lead to the disclosure of user credentials if a user is tricked into replying to a crafted email. While not observed in active exploitation, public exploit code exists, and there is no significant community discussion or media coverage surrounding this decade-old vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.3.0CPE matchmatch criteria | cpe:2.3:a:icewarp:email_server:*:*:*:*:*:*:*:* | ||
2.10.105CPE matchmatch criteria | cpe:2.3:a:icewarp:email_server:2.10.105:*:*:*:*:*:*:* | ||
2.10.110CPE matchmatch criteria | cpe:2.3:a:icewarp:email_server:2.10.110:*:*:*:*:*:*:* | ||
2.10.115CPE matchmatch criteria | cpe:2.3:a:icewarp:email_server:2.10.115:*:*:*:*:*:*:* | ||
2.10.140CPE matchmatch criteria | cpe:2.3:a:icewarp:email_server:2.10.140:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.