8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.9 High
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
71.2%
If a function is defined that has the same name as the default built-in email address validation scheme (php
), it will be called in default configuration as when no validation scheme is provided, the default scheme’s callable php
was being called. If an attacker is able to inject such a function into the application (a much bigger issue), it will be called whenever an email address is validated, such as when calling validateAddress()
.
Low impact – exploitation requires that an attacker can already inject code into an application, but it provides a trigger pathway.
This is patched in PHPMailer 6.5.0 by denying the use of simple strings as validator function names, which is a very minor BC break.
Inject your own email validator function.
Reported by Vikrant Singh Chauhan via huntr.dev.
CVE-2021-3603
If you have any questions or comments about this advisory:
github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2021-3603.yaml
github.com/PHPMailer/PHPMailer
github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3
github.com/PHPMailer/PHPMailer/releases/tag/v6.5.0
github.com/PHPMailer/PHPMailer/security/advisories/GHSA-77mr-wc79-m8j3
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YRMWGA4VTMXFB22KICMB7YMFZNFV3EJ
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJYSOFCUBS67J3TKR74SD3C454N7VTYM
nvd.nist.gov/vuln/detail/CVE-2021-3603
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3603
www.huntr.dev/bounties/1-PHPMailer/PHPMailer
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.9 High
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
71.2%