VULNERABILITY INTELLIGENCE
CVE-2009-1491
CVSS score9.3 HIGH
EPSS probability2.82%
CISA KEVNot currently listed
Published2009-05-05
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Description
McAfee GroupShield for Microsoft Exchange on Exchange Server 2000, and possibly other anti-virus or anti-spam products from McAfee or other vendors, does not scan X- headers for malicious content, which allows remote attackers to bypass virus detection via a crafted message, as demonstrated by a message with an X-Testing header and no message body.
Weakness classification
- CWE-20: Improper Input Validation