Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows

🗓️ 22 Jun 2021 15:17:51Reported by GitHub Advisory DatabaseType

Remote Code Execution vulnerability in PHPMailer 6.4.1 on Windows. Possible attack via unfiltered user-supplied `$lang_path`

Reporter	Title	Published	Views	Family All 19
Huntr	Code Injection in causefx/organizr	23 Jul 202108:59	–	huntr
ATTACKERKB	CVE-2021-34551	16 Jun 202118:15	–	attackerkb
BDU FSTEC	The vulnerability of the setLanguage() function in the PHPMailer library allows a hacker to execute arbitrary code.	18 Jun 202100:00	–	bdu_fstec
CNNVD	PHPMailer 代码问题漏洞	16 Jun 202100:00	–	cnnvd
CVE	CVE-2021-34551	16 Jun 202117:23	–	cve
Cvelist	CVE-2021-34551	16 Jun 202117:23	–	cvelist
Debian CVE	CVE-2021-34551	16 Jun 202117:23	–	debiancve
EUVD	EUVD-2021-1283	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 34 Update: php-phpmailer6-6.5.0-1.fc34	26 Jun 202101:01	–	fedora
Fedora	[SECURITY] Fedora 33 Update: php-phpmailer6-6.5.0-1.fc33	26 Jun 202101:08	–	fedora

Vulners

Node

phpmailer phpmailerRange<6.5.0composer

Source	Link
github	www.github.com/PHPMailer/PHPMailer/security/advisories/GHSA-7q44-r25x-wm4q
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-34551
github	www.github.com/PHPMailer/PHPMailer/commit/acd264bf17ff4ac5c915f0d4226dce8a9ea70bc3
github	www.github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/3YRMWGA4VTMXFB22KICMB7YMFZNFV3EJ/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/FJYSOFCUBS67J3TKR74SD3C454N7VTYM/
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2021-34551.yaml
github	www.github.com/PHPMailer/PHPMailer/releases/tag/v6.5.0
github	www.github.com/advisories/GHSA-7q44-r25x-wm4q

07 Feb 2024 18:15Current

8.3High risk

Vulners AI Score8.3

CVSS 25.1

CVSS 3.18.1

EPSS0.02803