CVE-2012-0796: Code Injection
Impact Arbitrary additional email headers can be injected via crafted From or Sender headers.
Patches Fixed in 2.2.1
Workarounds Filter user-supplied values prior to using them in From or Sender properties.
References https://nvd.nist.gov/vuln/detail/CVE-2012-0796
For more information If you have any questions or comments about this advisory: Open a private issue in the PHPMailer project
Other sources
class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0796?
CVE-2012-0796 has been classified as a high severity vulnerability due to its ability to allow arbitrary email header injection.
How do I fix CVE-2012-0796?
To fix CVE-2012-0796, upgrade to PHPMailer version 2.2.1 or later.
Which versions are affected by CVE-2012-0796?
CVE-2012-0796 affects multiple versions of Moodle, specifically versions from 1.9.1 up to 2.0.6.
What is the impact of CVE-2012-0796?
The impact of CVE-2012-0796 is that it allows attackers to inject arbitrary additional email headers, potentially leading to phishing attacks or email spoofing.
Are there any workarounds for CVE-2012-0796?
A recommended workaround for CVE-2012-0796 is to filter user-supplied values before using them in From or Sender properties.