CVE-2021-31988

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary SMTP headers in the generated test email.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1286 CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-319895.3A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump CVE-2021-31999.8Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. CVE-2021-319967.5An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. There is a double free in merge_sort::merge().CVE-2021-319977.8A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate CVE-2021-319987.8A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2,CVE-2021-319998.8A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the clu CVE-2021-32003.3Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, c CVE-2021-320007.1A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterpr CVE-2021-320016.5K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confident CVE-2021-320023.3Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network info CVE-2021-320035.5Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the s CVE-2021-320045.3This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows