PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if     such code is injected into the host project's scope by other means). If the $patternselect parameter to     validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global     namespace contains a function called php, it will be called in preference to the built-in validator of the     same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
    (CVE-2021-3603)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if
    such code is injected into the host project's scope by other means). If the $patternselect parameter to
    validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global
    namespace contains a function called php, it will be called in preference to the built-in validator of the
    same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
    (CVE-2021-3603)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5956-1 advisory.

    Dawid Golunski discovered that PHPMailer was not properly escaping user input data used as arguments to     functions executed by the system shell. An attacker could possibly use this issue to execute arbitrary     code. This issue only affected Ubuntu 16.04 ESM. (CVE-2016-10033, CVE-2016-10045)

    It was discovered that PHPMailer was not properly escaping characters in certain fields of the     code_generator.php example code. An attacker could possibly use this issue to conduct cross-site scripting     (XSS) attacks. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2017-11503)

    Yongxiang Li discovered that PHPMailer was not properly converting relative paths provided as user input     when adding attachments to messages, which could lead to relative image URLs being treated as absolute     local file paths and added as attachments. An attacker could possibly use this issue to access     unauthorized resources and expose sensitive information. This issue only affected Ubuntu 16.04 ESM.
    (CVE-2017-5223)

    Sehun Oh discovered that PHPMailer was not properly processing untrusted non-local file attachments, which     could lead to an object injection. An attacker could possibly use this issue to execute arbitrary code.
    This issue only affected Ubuntu 16.04 ESM. (CVE-2018-19296)

    Elar Lang discovered that PHPMailer was not properly escaping file attachment names, which could lead to a     misinterpretation of file types by entities processing the message. An attacker could possibly use this     issue to bypass attachment filters. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
    (CVE-2020-13625)

    It was discovered that PHPMailer was not properly handling callables in its validateAddress function,     which could result in untrusted code being called should the global namespace contain a function called     'php'. An attacker could possibly use this issue to execute arbitrary code. This issue was only fixed in     Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2021-3603)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mantis 2.25.1 and 2.25.2 releases report :

Security and maintenance release, PHPMailer update to 6.5.0

- 0028552: XSS in manage_custom_field_edit_page.php (CVE-2021-33557)

- 0028821: Update PHPMailer to 6.5.0 (CVE-2021-3603, CVE-2020-36326)

ID	Name	Product	Family	Severity
224047	Linux Distros Unpatched Vulnerability : CVE-2021-3603	Nessus	Misc.	high
411907	SCA: security update for phpmailer/phpmailer (GHSA-77mr-wc79-m8j3)	Tenable Cloud Security	SCA Checks	high
411907	SCA: security update for phpmailer/phpmailer (GHSA-77mr-wc79-m8j3)	Tenable Self-Hosted Container Security	SCA Checks	high
172589	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : PHPMailer vulnerabilities (USN-5956-1)	Nessus	Ubuntu Local Security Checks	critical
151500	FreeBSD : mantis -- multiple vulnerabilities (9b1699ff-d84c-11eb-92d6-1b6ff3dfe4d3)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2021-3603

high

Tenable Plugins

high

high

high

critical

critical