Threats tagged 'ghsa-xmwp-gcgj-p387'

Certain versions of CakePHP contain an email header injection vulnerability due to incomplete sanitization of header values in SmtpTransport and MailTransport. Attackers who can control custom email headers via Message::setHeaders() or Message::addHeaders() may inject bare carriage return (CR) or line feed (LF) characters, enabling injection of additional headers such as Bcc. This could allow redirection or alteration of outgoing emails.