Vulnerability · Published Jun 17, 2021 · Assigned by @huntrdev

CVE-2021-3603Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer

High 8.1

In plain English

A high-severity security flaw in PHPMailer from PHPMailer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)2.3%top 16.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libphp-phpmailer	6.6.3-1	DEBIAN-CVE-2021-3603
Debian:13	libphp-phpmailer	6.6.3-1	DEBIAN-CVE-2021-3603
Debian:14	libphp-phpmailer	6.6.3-1	DEBIAN-CVE-2021-3603
Packagist	phpmailer/phpmailer	6.5.0	GHSA-77mr-wc79-m8j3

Affected products (as reported)

Vendor	Product	Versions
PHPMailer	PHPMailer	unspecified – before 6.5.0

Weakness: CWE-829 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.huntr.dev/bounties/1-PHPMailer/PHPMailer/ x_refsource_CONFIRM
https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3 x_refsource_MISC
FEDORA-2021-bfc34b3d5c vendor-advisory, x_refsource_FEDORA
FEDORA-2021-ef548cb234 vendor-advisory, x_refsource_FEDORA