CVE-2018-1294: apache software foundation apache commons email Improper Input Validation
Vulnerability summary
CVE-2018-1294 is a high (CVSS 7.5) Improper Input Validation vulnerability in apache software foundation apache commons email. EPSS estimates a 2.77% chance of exploitation in the next 30 days, higher than 86% of scored vulnerabilities.
Timeline
- 20-03-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients, contents, etc.) might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You can mitigate this vulnerability for older versions of Commons Email by stripping line-breaks from data, that will be passed to Email.setBounceAddress(String).
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
2.77%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.77% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- commons_email≥ 1.0, ≤ 1.4
Apache software foundation1 product
- apache commons emailversions prior to 1.5
Mageia1 product
- apache-commons-email< 1.5-1.mga6
Org.apache.commons1 product
- commons-email< 1.5
Ubuntu1 product
- commons-email< 1.5-1
5 vendors · 5 products
