PHPMailer vulnerable to email header injection

보통 4.0CVE-2012-0796 · GHSA-398j-f7m7-795j · Published 17/07/2012 · updated 16/06/2026

요약

CVE-2012-0796은(는) phpmailer/phpmailer, moodle (moodle)에 영향을 주는 보통 (CVSS 4.0) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.7%, 전체 취약점의 76.9%보다 높음.
조치: 2.2.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
phpmailer/phpmailer Packagist	`< 2.2.1`	`2.2.1`
moodle moodle	`= 1.9.1= 1.9.10= 1.9.11= 1.9.12= 1.9.13= 1.9.14= 1.9.15= 1.9.2= 1.9.3= 1.9.4= 1.9.5= 1.9.6= 1.9.7= 1.9.8= 1.9.9= 2.0.0= 2.0.1= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.1.0= 2.1.1= 2.1.2= 2.1.3= 2.2.0`	No fix yet

Description

Impact

Arbitrary additional email headers can be injected via crafted From or Sender headers.

Patches

Fixed in 2.2.1

Workarounds

Filter user-supplied values prior to using them in From or Sender properties.

References

https://nvd.nist.gov/vuln/detail/CVE-2012-0796

For more information

If you have any questions or comments about this advisory:

Open a private issue in the PHPMailer project

NVD description

class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.

References

PHPMailer/PHPMailer security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2012-0796 · ADVISORY
bugzilla.redhat.com/show_bug.cgi · WEB
git.moodle.org/gw · WEB
PHPMailer/PHPMailer · PACKAGE
moodle.org/mod/forum/discuss.php · WEB
debian.org/security/2012/dsa-2421 · WEB
git.moodle.org/gw

phpmailer/phpmailer의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

phpmailer/phpmailer

Packagist

< 2.2.1

2.2.1

moodle

= 1.9.1= 1.9.10= 1.9.11= 1.9.12= 1.9.13= 1.9.14= 1.9.15= 1.9.2= 1.9.3= 1.9.4= 1.9.5= 1.9.6= 1.9.7= 1.9.8= 1.9.9= 2.0.0= 2.0.1= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.1.0= 2.1.1= 2.1.2= 2.1.3= 2.2.0

No fix yet

Description

Impact

Arbitrary additional email headers can be injected via crafted From or Sender headers.

Patches

Fixed in 2.2.1

Workarounds

Filter user-supplied values prior to using them in From or Sender properties.

References

https://nvd.nist.gov/vuln/detail/CVE-2012-0796

For more information

If you have any questions or comments about this advisory:

Open a private issue in the PHPMailer project

NVD description

phpmailer/phpmailer의 다른 취약점

모두 보기 →