1. CVE-Search
  2. CVE-2007-1900
ID CVE-2007-1900
Summary CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to inject arbitrary e-mail headers via an e-mail address with a '\n' character, which causes a regular expression to ignore the subsequent part of the address string.
References
Vulnerable Configurations
  • cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 11-10-2017 - 01:32)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:P/A:N
oval via4
accepted 2015-04-20T04:02:29.559-04:00
class vulnerability
contributors
  • name Michael Wood
    organization Hewlett-Packard
  • name Sushant Kumar Singh
    organization Hewlett-Packard
  • name Sushant Kumar Singh
    organization Hewlett-Packard
  • name Prashant Kumar
    organization Hewlett-Packard
  • name Mike Cokus
    organization The MITRE Corporation
description CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to inject arbitrary e-mail headers via an e-mail address with a '\n' character, which causes a regular expression to ignore the subsequent part of the address string.
family unix
id oval:org.mitre.oval:def:6067
status accepted
submitted 2008-10-30T17:10:24.000-04:00
title HP-UX running Apache, Remote Arbitrary Code Execution, Cross Site Scripting (XSS)
version 45
refmap via4
bid 23359
confirm http://www.php.net/releases/5_2_3.php
debian DSA-1283
fedora FEDORA-2007-2215
gentoo
  • GLSA-200705-19
  • GLSA-200710-02
hp
  • HPSBUX02262
  • SSRT071447
misc http://www.php-security.org/MOPB/PMOPB-45-2007.html
osvdb 33962
secunia
  • 24824
  • 25056
  • 25057
  • 25062
  • 25445
  • 25535
  • 26231
  • 27037
  • 27102
  • 27110
slackware SSA:2007-152-01
suse SUSE-SA:2007:032
trustix 2007-0023
ubuntu USN-455-1
vupen
  • ADV-2007-2016
  • ADV-2007-3386
xf php-filtervalidateemail-header-injection(33510)
statements via4
contributor Mark J Cox
lastmodified 2007-04-16
organization Red Hat
statement Not vulnerable. The filter extension was not shipped in the versions of PHP supplied for Red Hat Enterprise Linux 2.1, 3, 4, 5, Stronghold 4.0, or Red Hat Application Stack 1.
Last major update 11-10-2017 - 01:32
Published 10-04-2007 - 18:19
Last modified 11-10-2017 - 01:32
Back to Top