CVE-2018-19296 Phar object injection in PHPMailer
HighCVSS 8.8
EPSS 2.2%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmailer/phpmailer(Packagist) | >= 5.0.0, < 5.2.27 | 5.2.27 |
| phpmailer/phpmailer(Packagist) | = v5.2.10 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.11 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.12 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.13 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.14 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.15 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.16 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.17 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.18 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.19 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.2 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.20 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.21 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.22 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.23 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.24 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.25 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.26 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.4 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.5 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.6 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.7 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.8 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.9 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmailer/phpmailer(Packagist) | >= 6.0.0, < 6.0.6 | 6.0.6 |
| phpmailer/phpmailer(Packagist) | = v6.0.0 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v6.0.1 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v6.0.2 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v6.0.3 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v6.0.4 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v6.0.5 | No fix listed |
| debian/libphp-phpmailer(Debian:12) | < 5.2.14+dfsg-2.4 | 5.2.14+dfsg-2.4 |
| debian/libphp-phpmailer(Debian:14) | < 5.2.14+dfsg-2.4 | 5.2.14+dfsg-2.4 |
| debian/libphp-phpmailer(Debian:13) | < 5.2.14+dfsg-2.4 | 5.2.14+dfsg-2.4 |
| phpmailer project phpmailer | < 5.2.27 | 5.2.27 |
| phpmailer project phpmailer | >= 6.0.0, < 6.0.6 | 6.0.6 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| fedoraproject fedora | = 33 | No fix listed |
| fedoraproject fedora | = 34 | No fix listed |
| WordPress | >= 3.7, <= 5.7 | No fix listed |
References
- github.com vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com release-notes vendor-advisory
- github.com release-notes vendor-advisory
- [debian-lts-announce] 20181228 [SECURITY] [DLA 1591-2] libphp-phpmailer regression update mailing-list third-party-advisory
- FEDORA-2021-ecf4fed550 vendor-advisory
- FEDORA-2021-b21bbfa198 vendor-advisory
- lists.fedoraproject.org
- lists.fedoraproject.org
- DSA-4351 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2018-19296 vendor-advisory
- bugs.debian.org issue-tracking
- github.com