CVE-2021-3603
Assigner: @huntrdev
Published: 2021-06-17T12:09:42
State: PUBLISHED
affected: product: PHPMailer
vendor: PHPMailer
versions: lessThan: 6.5.0
status: affected
version: unspecified
versionType: custom
descriptions: value: PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
type: CWE
source: advisory: 1-PHPMailer/PHPMailer
discovery: EXTERNAL
title: Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer
x_generator: engine: Vulnogram 0.0.9