CVE-2011-4554

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via (1) " (double quote) and newline characters in an org name or (2) " (double quote) characters in an e-mail address, related to a "2nd Order SMTP Injection" issue.

Score

CVSS 2.0 5.5 Medium

Status

Modified - cve@mitre.org

Published

2011-12-06

Last modified

2024-09-17

Weaknesses

CWE-20

Affected products

• One Click Orgs (Oneclickorgs)

References

• http://dmcdonald.net/?page_id=43
• https://groups.google.com/group/oneclickorgs-devspace/msg/26c40a4cc9e127d2?hl=en&dmode=source&output=gplain