Description

class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.

Remediation

References

CVE-2012-0796

Related Vulnerabilities

MySQL CVE-2012-1697 Vulnerability (CVE-2012-1697)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-39111)

Jenkins Incorrect Authorization Vulnerability (CVE-2018-1999004)

XWiki Missing Authorization Vulnerability (CVE-2022-23617)

WordPress Plugin Frontend Uploader Cross-Site Scripting (0.9.2)

Severity

Medium

Classification

CVE-2012-0796 CWE-94

Tags

Missing Update Known Vulnerabilities