CVE-2009-1469 - CVE House
Back to Database
Status published Medium CVE-2009-1469

CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php...

Vulnerability Description

CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element of an XML document, as demonstrated by triggering an e-mail message from the server that contains a user's correct credentials, and requests that the user compose a reply that includes this message.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-1469

Credits & Attribution

No credits recorded in the NVD database.

References

More from icewarp

View All →
CVE-2022-35115
IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was...
Critical 9.8
CVE-2021-36580
Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep...
Medium 6.1
CVE-2020-8512
In IceWarp Webmail Server through 11.4.4.1, there is XSS in...
Medium 6.1
CVE-2020-27982
IceWarp 11.4.5.0 allows XSS via the language parameter....
Medium 6.1
CVE-2020-25925
Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient...
Medium 6.1

Affected Vendor

Affected Software

email server, webmail server
Vulnerable Versions:
0, 2.10.105, 2.10.110, 2.10.115, 2.10.140, 2.10.150, 2.10.165, 2.10.170, 2.10.190, 2.10.200, 2.10.210, 2.10.220, 2.10.240, 2.10.250, 2.10.260, 2.10.280, 2.10.290, 2.10.310, 2.10.320, 2.10.330, 2.10.331, 2.10.340, 2.10.350, 2.10.360, 3.00.100, 3.00.110, 3.00.120, 3.00.130, 3.00.140, 3.10.011, 3.10.110, 4.00.30, 4.2.1, 4.2.2, 4.2.3, 4.4.1, 4.4.2, 4.10.040, 4.10.050, 5.1.2, 5.1.3, 5.1.5, 5.3.0, 5.3.2, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.7.3, 5.8.2, 5.8.3, 5.8.4, 5.8.5, 5.8.6, 5.9.4, 6.0.2, 6.0.3, 6.0.5, 6.0.7, 6.1.0, 6.2.1, 7.0.1, 7.1.4, 7.1.6, 7.2.0, 7.4.0, 7.4.2, 7.4.5, 7.5.2, 7.6.0, 7.6.4, 8.0.1, 8.0.2, 8.0.3, 8.2.0, 8.2.2, 8.3.5, 8.3.8, 8.5.0, 8.9.1, 9.0.0, 9.1.0, 9.2.0

Timeline

Official Publish: May 5th, 2009
Last Modified: August 7th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.