GitHub Advisoryadvisory · Packagist

GHSA-398j-f7m7-795j PHPMailer vulnerable to email header injection

HIGH Published 2022-10-06 Modified 2023-02-15 Official page ↗
Aliases
CVE-2012-0796
Ecosystem
Packagist
Packages
phpmailer/phpmailer
Severity
High
Weaknesses
CWE-94
Reviewed
2022-10-06

Affected packages

• Packagist phpmailer/phpmailer: < 2.2.1 → fixed in 2.2.1

Description

Impact Arbitrary additional email headers can be injected via crafted From or Sender headers. Patches Fixed in 2.2.1 Workarounds Filter user-supplied values prior to using them in From or Sender properties. References https://nvd.nist.gov/vuln/detail/CVE-2012-0796 For more information If you have any questions or comments about this advisory: • Open a private issue in the PHPMailer project

Related

Alias · CVE (1)

  • CVE-2012-0796 class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References