CVE-2020-13625

PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.

CVSS v3.0 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-f7hx-fqxw-rvvj	Exploit Patch Third Party Advisory
https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6	Release Notes Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00014.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMH4TC5XTS3KZVGMSKEPPBZ2XTZCKKCX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFM3BZABL6RUHTVMXSC7OFMP4CKWMRPJ/
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
https://lists.debian.org/debian-lts-announce/2020/08/msg00004.html
https://usn.ubuntu.com/4505-1/

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:*

Information

Published : 2020-06-08 17:15

Updated : 2020-09-17 20:15

NVD link : CVE-2020-13625

Mitre link : CVE-2020-13625

JSON object : View

Products Affected

phpmailer_project

phpmailer

CWE

CWE-116

Improper Encoding or Escaping of Output

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-f7hx-fqxw-rvvj", "name": "https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-f7hx-fqxw-rvvj", "tags": ["Exploit", "Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6", "name": "https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6", "tags": ["Release Notes", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00014.html", "name": "[debian-lts-announce] 20200611 [SECURITY] [DLA 2244-1] libphp-phpmailer security update", "tags": [], "refsource": "MLIST"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMH4TC5XTS3KZVGMSKEPPBZ2XTZCKKCX/", "name": "FEDORA-2020-06e87e71fe", "tags": [], "refsource": "FEDORA"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFM3BZABL6RUHTVMXSC7OFMP4CKWMRPJ/", "name": "FEDORA-2020-0bbe6304e3", "tags": [], "refsource": "FEDORA"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html", "name": "openSUSE-SU-2020:1060", "tags": [], "refsource": "SUSE"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html", "name": "openSUSE-SU-2020:1106", "tags": [], "refsource": "SUSE"}, {"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00004.html", "name": "[debian-lts-announce] 20200802 [SECURITY] [DLA 2306-1] libphp-phpmailer security update", "tags": [], "refsource": "MLIST"}, {"url": "https://usn.ubuntu.com/4505-1/", "name": "USN-4505-1", "tags": [], "refsource": "UBUNTU"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-116"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2020-13625", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}}, "publishedDate": "2020-06-08T17:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "6.1.6"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-09-17T20:15Z"}