CVE Feed

    Dashboard / CVE / CVE-2017-15806

    CVE-2017-15806

    The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."

    Published:Nov 15, 2017
    Last Modified:Apr 20, 2025
    EPS:Nov 15, 2017
    EPSS Score:0.20401
    CVSS Score:8.1

    Affected Products

    Vendor
    Zetacomponents
    Product
    Mail

    Exploits

    https://www.exploit-db.com/exploits/43155

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High