CVE-2012-0796: Improper Control of Generation of Code ('Code Injection')

October 6, 2022

class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.

References

github.com/PHPMailer/PHPMailer/security/advisories/GHSA-398j-f7m7-795j
github.com/advisories/GHSA-398j-f7m7-795j

Detect and mitigate CVE-2012-0796 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →