CVE-2017-15806
- State
- Published
- Severity
- Not scored
- Published
- Nov 15, 2017
- Updated
- Aug 5, 2024
- Reserved
- Oct 23, 2017
Description
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 43155exploit
- https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability/
- https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong/
- https://github.com/zetacomponents/Mail/issues/58
- https://github.com/zetacomponents/Mail/releases/tag/1.8.2
- 101866vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.