CVEvulnerability
CVE-2017-15806
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-11-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."
Affected configurations
• zetacomponents mail (< 1.8.2)
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://www.securityfocus.com/bid/101866 Third Party Advisory, VDB Entry
- https://github.com/zetacomponents/Mail/issues/58 Issue Tracking, Third Party Advisory
- https://github.com/zetacomponents/Mail/releases/tag/1.8.2 Issue Tracking, Release Notes, Third Party Advisory
- https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability/ Issue Tracking, Third Party Advisory
- https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong/ Issue Tracking, Third Party Advisory
- https://www.exploit-db.com/exploits/43155/ Issue Tracking, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/101866 Third Party Advisory, VDB Entry
- https://github.com/zetacomponents/Mail/issues/58 Issue Tracking, Third Party Advisory
- https://github.com/zetacomponents/Mail/releases/tag/1.8.2 Issue Tracking, Release Notes, Third Party Advisory
- https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability/ Issue Tracking, Third Party Advisory
- https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong/ Issue Tracking, Third Party Advisory
- https://www.exploit-db.com/exploits/43155/ Issue Tracking, Third Party Advisory, VDB Entry