CVE-1999-0173: Medium severity matt wright formmail vulnerability
FormMail CGI program can be used by web servers other than the host server that the program resides on.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Matt Wright FormMailfrom your environment.If FormMail is not required, uninstall or remove the CGI program from the server to eliminate the risk.
- Configuration
Configure the FormMail CGI to only accept form submissions originating from the host server (or an explicitly enumerated set of trusted hosts). Implement server-side checks such as validating the Host/Referer header or verifying request source IPs so that other web servers cannot use the script.
Matt Wright FormMail restrict_remote_use = true - Compensating control
Restrict access to the FormMail CGI at the webserver or network level so only the local host or specified trusted hosts can reach the script (for example, use webserver access controls or firewall/ACL rules to block external servers).
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0173?
CVE-1999-0173 is considered a medium severity vulnerability.
How do I fix CVE-1999-0173?
To fix CVE-1999-0173, restrict access to the FormMail CGI script to only authorized hosts.
What are the risks associated with CVE-1999-0173?
The risks associated with CVE-1999-0173 include unauthorized use of the FormMail script for spamming or data manipulation.
What versions of Matt Wright FormMail are affected by CVE-1999-0173?
All versions of Matt Wright FormMail are potentially affected by CVE-1999-0173.
Is CVE-1999-0173 still relevant today?
Yes, CVE-1999-0173 is still relevant as many legacy systems using FormMail may remain vulnerable.