{"id":"CVE-2020-13625","published":"2020-06-08T16:03:22Z","modified":"2024-08-04T12:25:16Z","title":"PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote…","vendor":null,"product":null,"tier":"tail","description":{"text":"PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0378,"percentile":0.89921,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-f7hx-fqxw-rvvj","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/06/msg00014.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMH4TC5XTS3KZVGMSKEPPBZ2XTZCKKCX/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFM3BZABL6RUHTVMXSC7OFMP4CKWMRPJ/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00004.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://usn.ubuntu.com/4505-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]}],"priority":{"score":18.0,"factors":[{"name":"EPSS percentile","points":17.98}]},"affected":[{"ecosystem":"Packagist","package":"phpmailer/phpmailer","vulnerableRanges":["<6.1.6"],"patched":["6.1.6"],"from":["GHSA-f7hx-fqxw-rvvj"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0422","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-phpmailer-phpmailer-cve-2020-13625","children":[{"from":"CVE-2020-13625","to":"CVE-2020-36326","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/PHPMailer.php"],"commits":["https://github.com/PHPMailer/PHPMailer/commit/c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3","https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9"],"basis":"shared function","functions":["attachAll"]}]},{"from":"CVE-2020-13625","to":"CVE-2021-34551","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/PHPMailer.php","src/POP3.php","src/SMTP.php"],"commits":["https://github.com/PHPMailer/PHPMailer/commit/c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3","https://github.com/PHPMailer/PHPMailer/commit/acd264bf17ff4ac5c915f0d4226dce8a9ea70bc3"],"basis":"shared function","functions":["PHPMailer","POP3","SMTP"]}]}],"packageHistory":[{"cve":"CVE-2017-5223","published":"2017-01-16","fixed":"5.2.22","kev":false},{"cve":"CVE-2017-11503","published":"2017-07-20","fixed":"5.2.24","kev":false},{"cve":"CVE-2018-19296","published":"2018-11-16","fixed":"6.0.6","kev":false,"link":{"from":"CVE-2018-19296","to":"CVE-2020-13625","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmailer/phpmailer","fromFixed":"6.0.6","toFixed":"6.1.6","daysApart":570}]}},{"cve":"CVE-2020-13625","published":"2020-06-08","fixed":"6.1.6","kev":false},{"cve":"CVE-2020-36326","published":"2021-04-28","fixed":"6.4.1","kev":false},{"cve":"CVE-2021-34551","published":"2021-06-16","fixed":"6.5.0","kev":false},{"cve":"CVE-2021-3603","published":"2021-06-17","fixed":"6.5.0","kev":false}],"package":"Packagist:phpmailer/phpmailer"}}