Detections
Analytics
PHP < 4.2.3 Mail Function Header Spoofing
medium Nessus Network Monitor Plugin ID 1481
Synopsis
The remote web server is running a version of PHP which is 4.2.2 or older.Description
The remote web server is running a version of PHP which is 4.2.2 or older. This version has a bug in its mail() function which does not properly sanitize user input. As a result, users can forge email to make it look like it is coming from a different source that the server.Solution
Upgrade to PHP 4.2.3 or higher.See Also
Plugin Details
Severity: Medium
ID: 1481
Family: Web Servers
Published: 8/20/2004
Updated: 3/6/2019
Nessus ID: 11444
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:php:php
Patch Publication Date: 7/30/2003
Vulnerability Publication Date: 7/30/2003
Reference Information
CVE: CVE-2002-0985, CVE-2002-0986
BID: 5562