PT-2008-6674 · Catalyst It+4 · Mahara+4
Hunger
·
Published
2008-12-17
·
Updated
2022-05-14
·
CVE-2008-5619
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Chuggnutt HTML to Text Converter (affected versions not specified)
PHPMailer versions prior to 5.2.10
RoundCube Webmail versions 0.2-1.alpha through 0.2-3.beta
Mahara (affected versions not specified)
AtMail Open version 1.03
Description
The issue allows remote attackers to execute arbitrary code via crafted input that is processed by the
preg replace function with the eval switch. This is a result of a problem in the html2text.php file.Recommendations
For PHPMailer versions prior to 5.2.10, update to version 5.2.10 or later.
For RoundCube Webmail versions 0.2-1.alpha through 0.2-3.beta, consider upgrading to a version outside of this range.
For Mahara, At the moment, there is no information about a newer version that contains a fix for this vulnerability.
For AtMail Open version 1.03, consider upgrading to a version outside of this range.
As a temporary workaround, consider disabling the use of the
preg replace function with the eval switch until a patch is available.Exploit
RCE
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Atmail Open
Chuggnutt Html To Text Converter
Mahara
Phpmailer
Roundcube Webmail