PT-2017-14237

CVE-2017-15806

Published

2017-11-15

Updated

2022-05-17

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zeta Components Mail versions prior to 1.8.2

Description The issue is related to the send function in the ezcMailMtaTransport class, which does not properly restrict the set of characters used in the ezcMail returnPath property. This might allow remote attackers to execute arbitrary code via a crafted email address.

Recommendations For versions prior to 1.8.2, update to version 1.8.2 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers

CVE-2017-15806