{"id":"CVE-2020-36326","published":"2021-04-28T02:21:53Z","modified":"2024-08-04T17:23:10Z","title":"PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname","vendor":null,"product":null,"tier":"tail","description":{"text":"PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03095,"percentile":0.87703,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":17.5,"factors":[{"name":"EPSS percentile","points":17.54}]},"affected":[{"ecosystem":"Packagist","package":"phpmailer/phpmailer","vulnerableRanges":[">=6.1.8, <6.4.1"],"patched":["6.4.1"],"from":["GHSA-m298-fh5c-jc66"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1129","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-phpmailer-phpmailer-cve-2020-13625","parents":[{"from":"CVE-2020-13625","to":"CVE-2020-36326","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/PHPMailer.php"],"commits":["https://github.com/PHPMailer/PHPMailer/commit/c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3","https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9"],"basis":"shared function","functions":["attachAll"]}]},{"from":"CVE-2018-19296","to":"CVE-2020-36326","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts.","from":"CVE.org","in":"CVE-2020-36326"}]}],"children":[{"from":"CVE-2020-36326","to":"CVE-2021-34551","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmailer/phpmailer","fromFixed":"6.4.1","toFixed":"6.5.0","daysApart":49},{"kind":"same-code","provenance":"machine","files":["src/PHPMailer.php"],"commits":["https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9","https://github.com/PHPMailer/PHPMailer/commit/acd264bf17ff4ac5c915f0d4226dce8a9ea70bc3"],"basis":"shared function","functions":["setLanguage"]}]}],"packageHistory":[{"cve":"CVE-2017-11503","published":"2017-07-20","fixed":"5.2.24","kev":false},{"cve":"CVE-2018-19296","published":"2018-11-16","fixed":"6.0.6","kev":false},{"cve":"CVE-2020-13625","published":"2020-06-08","fixed":"6.1.6","kev":false},{"cve":"CVE-2020-36326","published":"2021-04-28","fixed":"6.4.1","kev":false},{"cve":"CVE-2021-34551","published":"2021-06-16","fixed":"6.5.0","kev":false},{"cve":"CVE-2021-3603","published":"2021-06-17","fixed":"6.5.0","kev":false,"link":{"from":"CVE-2020-36326","to":"CVE-2021-3603","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmailer/phpmailer","fromFixed":"6.4.1","toFixed":"6.5.0","daysApart":50},{"kind":"same-code","provenance":"machine","files":["src/PHPMailer.php"],"commits":["https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9","https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3"],"basis":"shared file"}]}}],"package":"Packagist:phpmailer/phpmailer"}}