PT-2017-14237

CVE-2017-15806

Publicado

2017-11-15

Atualizado

2022-05-17

Descrição por

CVSS 3.1

8.1

Alta

MétricasAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zeta Components Mail versions prior to 1.8.2

Description The issue is related to the send function in the ezcMailMtaTransport class, which does not properly restrict the set of characters used in the ezcMail returnPath property. This might allow remote attackers to execute arbitrary code via a crafted email address.

Recommendations For versions prior to 1.8.2, update to version 1.8.2 or later to resolve the issue.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Identificadores relacionados

CVE-2017-15806