CRLF Injection Vulnerability in IceWarp eMail Server and WebMail Server
CVE-2009-1469

Currently unrated

Key Information:

Vendor: Icewarp
Status: Email Server; Webmail Server
Vendor: CVE Published:; 5 May 2009

What is CVE-2009-1469?

The CRLF injection vulnerability in IceWarp eMail Server and WebMail Server allows remote attackers to manipulate the 'Forgot Password' functionality. This weakness enables attackers to craft deceptive email messages that can trick users into inadvertently disclosing their credentials. The issue arises from the inclusion of CRLF sequences before the Reply-To header in the XML document's subject element. When the server generates an email containing valid user credentials, users may be misled into responding with sensitive information.