CVE-2019-17123

Name of the Vulnerable Software and Affected Versions eGain Web Email API versions 11 and later

Description The issue allows for spoofed messages due to mishandling of the fromName and message fields in the /system/ws/v11/ss/email API endpoint. This can be demonstrated through fromName header injection using a %0a or %0d character. Additionally, the message parameter can contain initial HTML comment characters.

Recommendations For eGain Web Email API versions 11 and later, consider disabling the /system/ws/v11/ss/email API endpoint until a patch is available to prevent exploitation. Restrict access to the fromName and message fields to minimize the risk of header injection. Avoid using the fromName and message parameters in the affected API endpoint until the issue is resolved.