NVD

Id
7111  
Name
CVE-2017-5223  
Description
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.  
Reject
 
CVSS Version
2  
CVSS Score
2.1  
Severity
Low  
CVSS Base Score
2.1  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2017-01-16  
Modified Date
2017-01-18  
Seq
2017-5223  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
39841 7111 CVE-2017-5223 http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis/  View
39842 7111 CVE-2017-5223 95328  View
39843 7111 CVE-2017-5223 https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
64724 JVNDB-2017-001110 PHPMailer の msgHTML メソッドにおける画像の相対 URL が絶対ローカルファイルパスとして処理される脆弱性 PHPMailer の msgHTML メソッドには、ベースディレクトリが設定されていない場合、画像の相対 URL が絶対ローカルファイルパスとして処理され、添付ファイルとして追加される脆弱性が存在します。 CVE-2017-5223 CVE-2017-5223 7111 2.1 5.5 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-001110.html 2017-01-09 2017-01-30 View