VULNERABILITY INTELLIGENCE
CVE-2017-15806
CVSS score8.1 HIGH
EPSS probability10.65%
CISA KEVNot currently listed
Published2017-11-15
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."
Weakness classification
- CWE-94: Improper Control of Generation of Code ('Code Injection')
Primary references
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Issue Tracking, Third Party Advisory
- cve@mitre.org — Issue Tracking, Release Notes, Third Party Advisory
- cve@mitre.org — Issue Tracking, Third Party Advisory
- cve@mitre.org — Issue Tracking, Third Party Advisory
- cve@mitre.org — Issue Tracking, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Release Notes, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory, VDB Entry