CVE-2008-5619
7.1 High
AI Score
Confidence
Low
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.886 High
EPSS
Percentile
98.7%
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
| CPE | Name | Operator | Version |
|---|---|---|---|
| roundcube:webmail | roundcube webmail | eq | 0.2.1 |
| roundcube:webmail | roundcube webmail | eq | 0.2.3 |
References
mahara.org/interaction/forum/topic.php?id=533
osvdb.org/53893
secunia.com/advisories/33145
secunia.com/advisories/33170
secunia.com/advisories/34789
sourceforge.net/forum/forum.php?forum_id=898542
trac.roundcube.net/changeset/2148
trac.roundcube.net/ticket/1485618
www.openwall.com/lists/oss-security/2008/12/12/1
www.securityfocus.com/archive/1/499489/100/0/threaded
www.vupen.com/english/advisories/2008/3418
www.vupen.com/english/advisories/2008/3419
github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a
www.exploit-db.com/exploits/7549
www.exploit-db.com/exploits/7553
www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html
www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html
Related
7.1 High
AI Score
Confidence
Low
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.886 High
EPSS
Percentile
98.7%