PT-2017-14237 · Ez Systems · Zeta Components Mail

Kay · Publicado 2017-11-15 · Atualizado 2022-05-17 · CVE-2017-15806

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zeta Components Mail versions prior to 1.8.2

Description The issue is related to the send function in the ezcMailMtaTransport class, which does not properly restrict the set of characters used in the ezcMail returnPath property. This might allow remote attackers to execute arbitrary code via a crafted email address.

Recommendations For versions prior to 1.8.2, update to version 1.8.2 or later to resolve the issue.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2017-15806

GHSA-HGR8-G756-VMG9

Produtos afetados

Zeta Components Mail

Referências · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zetacomponents/mail/CVE-2017-15806.yaml · Exploit
• 🔥 https://exploit-db.com/exploits/43155 · Exploit
• https://github.com/zetacomponents/Mail · Nota
• https://github.com/zetacomponents/Mail/releases/tag/1.8.2 · Nota
• https://github.com/zetacomponents/Mail/issues/58 · Nota
• https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-15806 · Nota de Segurança
• https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong · Nota
• http://securityfocus.com/bid/101866 · Nota
• https://osv.dev/vulnerability/GHSA-hgr8-g756-vmg9 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-15806 · Aviso do Fabricante