Swoosh
Monthly
URL path injection in Swoosh's Microsoft Graph adapter allows an attacker to redirect authenticated Graph API requests by embedding URL-special characters in the sender's email address. Applications that derive the 'from' address from untrusted input (e.g., contact forms, relays) are affected. The vulnerability is patched in version 1.26.3; no active exploitation is currently reported.
URL path injection in Swoosh's Microsoft Graph adapter allows an attacker to redirect authenticated Graph API requests by embedding URL-special characters in the sender's email address. Applications that derive the 'from' address from untrusted input (e.g., contact forms, relays) are affected. The vulnerability is patched in version 1.26.3; no active exploitation is currently reported.