CVE-2019-17123

HIGH 7.5CVE-2019-17123 · Published 13/12/2019 · updated 17/06/2026

In short

CVE-2019-17123 is a HIGH (CVSS 7.5) vulnerability affecting mail (egain).
Chance of exploitation in the next 30 days (EPSS): 0.98%, higher than 62.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mail egain	`≥ 11`	No fix yet

Description

The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. (Also, the message parameter can have initial HTML comment characters.)

References

egain.com/products/email-management-software · Product
medium.com/maverislabs/cve-2019-17123-cbc946c99f8 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free