Vulnerabilities > CVE-2021-3603 - Inclusion of Functionality from Untrusted Control Sphere vulnerability in multiple products

CVSS 8.1 - HIGH

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

high complexity

phpmailer-project

fedoraproject

CWE-829

NVD

Published: 2021-06-17

Updated: 2023-11-07

Summary

PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.

Vulnerable Configurations

Part	Description	Count
Application	Phpmailer_Project Phpmailer Project Phpmailer 2.0.3 Phpmailer Project Phpmailer 2.2.1 Phpmailer Project Phpmailer 2.3.0 Phpmailer Project Phpmailer 5.0.0 Phpmailer Project Phpmailer 5.0.2 Phpmailer Project Phpmailer 5.1.0 Phpmailer Project Phpmailer 5.2.0 Phpmailer Project Phpmailer 5.2.1 Phpmailer Project Phpmailer 5.2.2 Phpmailer Project Phpmailer 5.2.4 Phpmailer Project Phpmailer 5.2.5 Phpmailer Project Phpmailer 5.2.6 Phpmailer Project Phpmailer 5.2.7 Phpmailer Project Phpmailer 5.2.8 Phpmailer Project Phpmailer 5.2.9 Phpmailer Project Phpmailer 5.2.10 Phpmailer Project Phpmailer 5.2.11 Phpmailer Project Phpmailer 5.2.12 Phpmailer Project Phpmailer 5.2.13 Phpmailer Project Phpmailer 5.2.14 Phpmailer Project Phpmailer 5.2.15 Phpmailer Project Phpmailer 5.2.16 Phpmailer Project Phpmailer 5.2.17 Phpmailer Project Phpmailer 5.2.18 Phpmailer Project Phpmailer 5.2.19 Phpmailer Project Phpmailer 5.2.20 Phpmailer Project Phpmailer 5.2.21 Phpmailer Project Phpmailer 5.2.22 Phpmailer Project Phpmailer 5.2.23 Phpmailer Project Phpmailer 5.2.24 Phpmailer Project Phpmailer 5.2.25 Phpmailer Project Phpmailer 5.2.26 Phpmailer Project Phpmailer 5.2.27 Phpmailer Project Phpmailer 5.2.28 Phpmailer Project Phpmailer 6.0.0 Phpmailer Project Phpmailer 6.0.1 Phpmailer Project Phpmailer 6.0.2 Phpmailer Project Phpmailer 6.0.3 Phpmailer Project Phpmailer 6.0.4 Phpmailer Project Phpmailer 6.0.5 Phpmailer Project Phpmailer 6.0.6 Phpmailer Project Phpmailer 6.0.7 Phpmailer Project Phpmailer 6.1.5 Phpmailer Project Phpmailer 6.1.6 Phpmailer Project Phpmailer 6.1.7 Phpmailer Project Phpmailer 6.1.8 Phpmailer Project Phpmailer 6.2.0 Phpmailer Project Phpmailer 6.3.0 Phpmailer Project Phpmailer 6.4.0 Phpmailer Project Phpmailer 6.4.1	55
OS	Fedoraproject Fedoraproject Fedora 33 Fedoraproject Fedora 34	2

Common Weakness Enumeration (CWE)

CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References