CakePHP: SmtpTransport vulnerable to CRLF header injection

Severity breakdown

• Attack vector Network Requires network access to the vulnerable service
• Attack complexity Low No extra steps to bypass built-in attack protections
• Required conditions Present Attack depends on particular deployment or execution conditions
• Privileges required None Attacker needs no account or login
• User action None No action by another user is required
• Vulnerable system: Data exposure None No data disclosure
• Vulnerable system: Data changes High Protected data can be changed with serious impact
• Vulnerable system: Service disruption None No availability impact
• Other systems: Data exposure None No additional impact beyond the vulnerable system
• Other systems: Data changes None No additional impact beyond the vulnerable system
• Other systems: Service disruption None No additional impact beyond the vulnerable system