kbrain

CVE-2009-1469

MEDIUM · CVSS 4.3EPSS 4.9%EU EUVD

CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element of an XML document, as demonstrated by triggering an e-mail message from the server that contains a user's correct credentials, and requests that the user compose a reply that includes this message.

Key facts

CVSS score
4.3 (v2.0)
Severity
MEDIUM
CVSS vector
AV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness (CWE)
CWE-94
EPSS score
4.9% (92th percentile)
In CISA KEV
No
In EU EUVD
Yes (EUVD-2009-1467)
Published
May 5, 2009
NVD last modified
June 16, 2026
Status
Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-1467 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server
  • icewarp / email server

and 126 more…

References

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain