CVE-2018-19296: High severity PHPMailer project PHPMailer vulnerability
Last updated 24 July 2024
Other sources
PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
— Launchpad
PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing phar:// paths into addAttachment() and other functions that may receive unfiltered local paths, possibly leading to RCE. See this article for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as phar://. Reported by Sehun Oh of cyberone.kr.
Impact Object injection, possible remote code execution
Patches Fixed in 6.0.6 and 5.2.27
Workarounds Validate and sanitise user input before using.
References https://nvd.nist.gov/vuln/detail/CVE-2018-19296
For more information If you have any questions or comments about this advisory: Open a private issue in the PHPMailer project
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for the Object Injection vulnerability?
The vulnerability ID for the Object Injection vulnerability is CVE-2018-19296.
What is the severity of the Object Injection vulnerability?
The severity of the Object Injection vulnerability is high with a severity value of 8.8.
What is affected by the Object Injection vulnerability?
The Object Injection vulnerability affects PHPMailer before 5.2.27 and 6.x before 6.0.6, as well as other packages and systems listed in the vulnerability description.
How can I fix the Object Injection vulnerability?
To fix the Object Injection vulnerability, update PHPMailer to version 5.2.27 or 6.0.6 and follow any additional remediation steps mentioned in the relevant advisories.
Where can I find more information about the Object Injection vulnerability?
More information about the Object Injection vulnerability can be found on the official PHPMailer GitHub releases page, the Debian Security Tracker, and the MITRE CVE database.