HTTP Header Injection
CVE-2021-23400

6.3MEDIUM

Key Information:

Vendor

Nodemailer

Status
Nodemailer
Vendor
CVE Published:
29 June 2021

What is CVE-2021-23400?

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

Affected Version(s)

nodemailer < 6.6.1

References

https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737
x_refsource_MISC
https://github.com/nodemailer/nodemailer/issues/1289
x_refsource_MISC

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Williams
.