SMTP Injection in PHPMailer

2020-03-0522:09:19

Google

osv.dev

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

64.9%

JSON

Impact

Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.

Patches

Fixed in 5.2.14 in this commit.

Workarounds

Manually strip line breaks from email addresses before passing them to PHPMailer.

References

https://nvd.nist.gov/vuln/detail/CVE-2015-8476

For more information

If you have any questions or comments about this advisory:

Open a private issue in the PHPMailer project

CPENameOperatorVersion
phpmailer/phpmailereq5.2.7
phpmailer/phpmailereq5.2.4
phpmailer/phpmailereq5.2.5
phpmailer/phpmailereq5.2.9
phpmailer/phpmailereq5.2.8
phpmailer/phpmailereq5.2.10
phpmailer/phpmailereq5.2.13
phpmailer/phpmailereq5.2.2
phpmailer/phpmailereq5.2.11
phpmailer/phpmailereq5.2.6

Name	Operator	Version
phpmailer/phpmailer	eq	5.2.7
phpmailer/phpmailer	eq	5.2.4
phpmailer/phpmailer	eq	5.2.5
phpmailer/phpmailer	eq	5.2.9
phpmailer/phpmailer	eq	5.2.8
phpmailer/phpmailer	eq	5.2.10
phpmailer/phpmailer	eq	5.2.13
phpmailer/phpmailer	eq	5.2.2
phpmailer/phpmailer	eq	5.2.11
phpmailer/phpmailer	eq	5.2.6