CVE-2015-8476
mediumpriority · track · 21EPSS 0.020 · 81 %ileEURUUSEPSS · scored 2026-10-27
Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (9)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-738m-f33v-qc2rSMTP Injection in PHPMailer2020-03-05ghsa · osvUS
### Impact Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts. ### Patches Fixed in 5.2.14 in [this commit](https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0). ### Workarounds Manually strip line breaks from email addresses before passing them to PHPMailer. ### References https://nvd.nist.gov/vuln/detail/CVE-2015-8476 ### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (22)
External citations — patches, advisories, analysis.
- http://www.debian.org/security/2015/dsa-3416cnnvd
- http://www.openwall.com/lists/oss-security/2015/12/04/5cnnvd
- http://www.openwall.com/lists/oss-security/2015/12/05/1cnnvd
- http://www.securityfocus.com/bid/78619cnnvd
- https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0cnnvd
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14cnnvd
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.htmlenisa_euvd
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.htmlenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan