En bref
- CVE-2015-8476 est une vulnérabilité MOYENNE (CVSS 5.0) touchant phpmailer/phpmailer, phpmailer (phpmailer project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.0%, plus élevée que 80.6% des vulnérabilités.
- Correctif : mettre à jour vers 5.2.14 ou plus récent.
Description
Impact
Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.
Patches
Fixed in 5.2.14 in this commit.
Workarounds
Manually strip line breaks from email addresses before passing them to PHPMailer.
References
https://nvd.nist.gov/vuln/detail/CVE-2015-8476
For more information
If you have any questions or comments about this advisory:
NVD description
Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
Autres vulnérabilités de phpmailer/phpmailer
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free