Geeklog Email Composition CRLF Injection Vulnerability
BID:5271
Info
Geeklog Email Composition CRLF Injection Vulnerability
| Bugtraq ID: | 5271 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 19 2002 12:00AM |
| Updated: | Jul 19 2002 12:00AM |
| Credit: | Discovery credited to Ulf Harnhammar <[email protected]>. |
| Vulnerable: |
Geeklog Geeklog 1.3.5 sr1 Geeklog Geeklog 1.3.5 |
| Not Vulnerable: |
Geeklog Geeklog 1.3.5 sr2 |
Discussion
Geeklog Email Composition CRLF Injection Vulnerability
A vulnerability has been reported for Geeklog that may allow an attacker to include extra email headers when composing email to other Geeklog users.
Geeklog prevents the disclosure of a user's real email address for privacy reasons. However an attacker is able to obtain a user's real email address by including extra headers when composing an email using Geeklog's 'Send Email' facility.
A vulnerability has been reported for Geeklog that may allow an attacker to include extra email headers when composing email to other Geeklog users.
Geeklog prevents the disclosure of a user's real email address for privacy reasons. However an attacker is able to obtain a user's real email address by including extra headers when composing an email using Geeklog's 'Send Email' facility.