CVE-2017-11503 Cross-site scripting in PHPMailer
MediumCVSS 6.1
EPSS 2.4%
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmailer/phpmailer(Packagist) | >= 5.0.0, < 5.2.24 | 5.2.24 |
| phpmailer/phpmailer(Packagist) | = v5.2.10 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.11 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.12 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.13 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.14 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.15 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.16 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.17 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.18 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.19 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.2 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.20 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.21 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.22 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.23 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.4 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.5 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.6 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.7 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.8 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.9 | No fix listed |
| debian/libphp-phpmailer(Debian:12) | < 6.0.6-0.1 | 6.0.6-0.1 |
| debian/libphp-phpmailer(Debian:14) | < 6.0.6-0.1 | 6.0.6-0.1 |
| debian/libphp-phpmailer(Debian:13) | < 6.0.6-0.1 | 6.0.6-0.1 |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmailer project phpmailer | = 5.2.23 | No fix listed |
References
- github.com vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- cxsecurity.com exploit third-party-advisory
- github.com exploit
- github.com patch release-notes third-party-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 99293 third-party-advisory vdb-entry
- 1039026 third-party-advisory vdb-entry
- github.com
- Debian Security Tracker CVE-2017-11503 vendor-advisory
- github.com product