PT-2008-6674 · Catalyst It+4 · Mahara+4
Hunger
·
Publicado
2008-12-17
·
Atualizado
2022-05-14
·
CVE-2008-5619
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Chuggnutt HTML to Text Converter (affected versions not specified)
PHPMailer versions prior to 5.2.10
RoundCube Webmail versions 0.2-1.alpha through 0.2-3.beta
Mahara (affected versions not specified)
AtMail Open version 1.03
Description
The issue allows remote attackers to execute arbitrary code via crafted input that is processed by the
preg replace function with the eval switch. This is a result of a problem in the html2text.php file.Recommendations
For PHPMailer versions prior to 5.2.10, update to version 5.2.10 or later.
For RoundCube Webmail versions 0.2-1.alpha through 0.2-3.beta, consider upgrading to a version outside of this range.
For Mahara, At the moment, there is no information about a newer version that contains a fix for this vulnerability.
For AtMail Open version 1.03, consider upgrading to a version outside of this range.
As a temporary workaround, consider disabling the use of the
preg replace function with the eval switch until a patch is available.Exploit
RCE
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Atmail Open
Chuggnutt Html To Text Converter
Mahara
Phpmailer
Roundcube Webmail