CVE-2021-3603
Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
PHPMailer versión 6.4.1 y anteriores contienen una vulnerabilidad que puede resultar en la llamada de código no confiable (si dicho código es inyectado en el ámbito del proyecto anfitrión por otros medios). Si el parámetro $patternselect de la función validateAddress() es ajustada como "php" (el valor predeterminado, definido por PHPMailer::$validator), y el namespace global contiene una función llamada php, ésta será llamada con preferencia al validador incorporado del mismo nombre. Mitigado en PHPMailer versión 6.5.0 negando el uso de cadenas simples como nombres de funciones de validador
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-06-15 CVE Reserved
- 2021-06-17 CVE Published
- 2024-03-02 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://www.huntr.dev/bounties/1-PHPMailer/PHPMailer | Product |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Phpmailer Project Search vendor "Phpmailer Project" | Phpmailer Search vendor "Phpmailer Project" for product "Phpmailer" | <= 6.4.1 Search vendor "Phpmailer Project" for product "Phpmailer" and version " <= 6.4.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
| ||||||