CVE-2017-20187 LOW

CVE-2017-20187: Magnesium-PHP Base.php formatEmailString injection

Vendor N/A

Product Magnesium-PHP

Weakness CWE-74

Published November 5, 2023

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

3.5/10

Attack vector Adjacent

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3.1 is able to address this issue. The patch is identified as 500d340e1f6421007413cc08a8383475221c2604. It is recommended to upgrade the affected component. VDB-244482 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Key dates

02Disclosure timeline

November 5, 2023 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2017-20187 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/74.html AskarLabs — CWE-74 write-up Improper Neutralization of Special Elements in Output ('Injection')

Related vulnerabilities

Identifiers

CVE CVE-2017-20187

CWE CWE-74

CVSS 3.5 / LOW

Affected versions

Vendor N/A

Product Magnesium-PHP

Affected 0.1

Vendor N/A

Product Magnesium-PHP

Affected 0.2

Vendor N/A

Product Magnesium-PHP

Affected 0.3

CVE-2017-20187: Magnesium-PHP Base.php formatEmailString injection

01Description

02Disclosure timeline

03References

04Related CVE