CVE-2021-3603highCWE-829

CVE-2021-3603: falha de alta gravidade em PHPMailer

Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar PHPMailer+ Monitorar phpmailer/phpmailer

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 2.3%
PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
PHPMailer · PHPMailer