PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 05:29
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9 - Patch, Third Party Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B/ - | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT/ - |
07 Nov 2023, 03:22
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2021-04-28 03:15
Updated : 2024-11-21 05:29
NVD link : CVE-2020-36326
Mitre link : CVE-2020-36326
CVE.ORG link : CVE-2020-36326
JSON object : View
Products Affected
wordpress
- wordpress
phpmailer_project
- phpmailer
CWE
CWE-502
Deserialization of Untrusted Data