CVE-2021-3603: fedoraproject fedora
Vulnerability summary
CVE-2021-3603 is a high (CVSS 8.1) vulnerability in fedoraproject fedora. EPSS estimates a 2.26% chance of exploitation in the next 30 days, higher than 82.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 17-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.26%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.26% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mageia2 products
- php-phpmailer< 6.5.0-1.mga7
- php-phpmailer< 6.5.0-1.mga8
Debian1 product
- libphp-phpmailer< 6.6.3-1
Fedoraproject1 product
- fedoraEOL33 | 34
Phpmailer1 product
- phpmailer≥ unspecified, < 6.5.0
Phpmailer_project1 product
- phpmailer≤ 6.4.1
Ubuntu1 product
- libphp-phpmailer< 6.0.6-0.1ubuntu0.1~esm1 | < 6.2.0-2ubuntu0.1~esm1
6 vendors · 7 products
References
12 links- github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3X Refsource MISCREPORTPatchThird Party Advisory
