PT-2017-14237 · Ez Systems · Zeta Components Mail

Kay · Published 2017-11-15 · Updated 2022-05-17 · CVE-2017-15806

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zeta Components Mail versions prior to 1.8.2

Description The issue is related to the send function in the ezcMailMtaTransport class, which does not properly restrict the set of characters used in the ezcMail returnPath property. This might allow remote attackers to execute arbitrary code via a crafted email address.

Recommendations For versions prior to 1.8.2, update to version 1.8.2 or later to resolve the issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-15806

GHSA-HGR8-G756-VMG9

Affected Products

Zeta Components Mail

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zetacomponents/mail/CVE-2017-15806.yaml · Exploit
• 🔥 https://exploit-db.com/exploits/43155 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-15806 · Security Note
• https://osv.dev/vulnerability/GHSA-hgr8-g756-vmg9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15806 · Vendor Advisory
• https://github.com/zetacomponents/Mail · Note
• https://github.com/zetacomponents/Mail/releases/tag/1.8.2 · Note
• https://github.com/zetacomponents/Mail/issues/58 · Note
• https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability · Note
• https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong · Note
• http://securityfocus.com/bid/101866 · Note