Vulnerability Details CVE-2021-3603
PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 57.2%
CVSS Severity
CVSS v3 Score 8.1
CVSS v2 Score 6.8
References
- https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YRMWGA4VTMXFB22KICMB7YMFZNFV3EJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJYSOFCUBS67J3TKR74SD3C454N7VTYM/
- https://www.huntr.dev/bounties/1-PHPMailer/PHPMailer/
- https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YRMWGA4VTMXFB22KICMB7YMFZNFV3EJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJYSOFCUBS67J3TKR74SD3C454N7VTYM/
- https://www.huntr.dev/bounties/1-PHPMailer/PHPMailer/
Products affected by CVE-2021-3603
-
cpe:2.3:a:phpmailer_project:phpmailer:2.0.3
-
cpe:2.3:a:phpmailer_project:phpmailer:2.2.1
-
cpe:2.3:a:phpmailer_project:phpmailer:2.3.0
-
cpe:2.3:a:phpmailer_project:phpmailer:5.0.0
-
cpe:2.3:a:phpmailer_project:phpmailer:5.0.2
-
cpe:2.3:a:phpmailer_project:phpmailer:5.1.0
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.0
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.1
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.10
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.11
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.12
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.13
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.14
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.15
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.16
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.17
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.18
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.19
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.2
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.20
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.21
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.22
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.23
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.24
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.25
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.26
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.27
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.28
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.4
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.5
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.6
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.7
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.8
-
cpe:2.3:a:phpmailer_project:phpmailer:5.2.9
-
cpe:2.3:a:phpmailer_project:phpmailer:6.0.0
-
cpe:2.3:a:phpmailer_project:phpmailer:6.0.1
-
cpe:2.3:a:phpmailer_project:phpmailer:6.0.2
-
cpe:2.3:a:phpmailer_project:phpmailer:6.0.3
-
cpe:2.3:a:phpmailer_project:phpmailer:6.0.4
-
cpe:2.3:a:phpmailer_project:phpmailer:6.0.5
-
cpe:2.3:a:phpmailer_project:phpmailer:6.0.6
-
cpe:2.3:a:phpmailer_project:phpmailer:6.0.7
-
cpe:2.3:a:phpmailer_project:phpmailer:6.1.5
-
cpe:2.3:a:phpmailer_project:phpmailer:6.1.6
-
cpe:2.3:a:phpmailer_project:phpmailer:6.1.7
-
cpe:2.3:a:phpmailer_project:phpmailer:6.1.8
-
cpe:2.3:a:phpmailer_project:phpmailer:6.2.0
-
cpe:2.3:a:phpmailer_project:phpmailer:6.3.0
-
cpe:2.3:a:phpmailer_project:phpmailer:6.4.0
-
cpe:2.3:a:phpmailer_project:phpmailer:6.4.1
-
cpe:2.3:o:fedoraproject:fedora:33
-
cpe:2.3:o:fedoraproject:fedora:34