Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2017-5223 | First vendor Publication | 2017-01-16 |
| Vendor | Cve | Last vendor Modification | 2017-10-28 |
Security-Database Scoring CVSS v3
| Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | |||
|---|---|---|---|
| Overall CVSS Score | 5.5 | ||
| Base Score | 5.5 | Environmental Score | 5.5 |
| impact SubScore | 3.6 | Temporal Score | 5.5 |
| Exploitabality Sub Score | 1.8 | ||
| Attack Vector | Local | Attack Complexity | Low |
| Privileges Required | Low | User Interaction | None |
| Scope | Unchanged | Confidentiality Impact | High |
| Integrity Impact | None | Availability Impact | None |
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 2.1 | Attack Range | Local |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5223 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-200 | Information Exposure |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2018-11-06 | PHPMailer information disclosure attempt RuleID : 48029 - Revision : 2 - Type : SERVER-MAIL |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2017-02-07 | Name : The remote Debian host is missing a security update. File : debian_DLA-817.nasl - Type : ACT_GATHER_INFO |
| 2017-01-18 | Name : The remote Fedora host is missing a security update. File : fedora_2017-c3dc97e1e1.nasl - Type : ACT_GATHER_INFO |
| 2017-01-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_7ae0be99d8bb11e69b7fd43d7e971a1b.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-05 01:26:26 |
|
| 2021-04-22 02:16:46 |
|
| 2020-05-23 02:07:39 |
|
| 2020-05-23 01:02:32 |
|
| 2019-10-03 12:09:48 |
|
| 2017-10-28 09:23:26 |
|
| 2017-02-08 13:25:30 |
|
| 2017-01-19 13:25:05 |
|
| 2017-01-18 21:24:03 |
|
| 2017-01-18 09:28:30 |
|
| 2017-01-16 12:00:59 |
|
