| Vulnerability Name: | CVE-2016-10034 (CCN-120212) | ||||||||||||||||||||
| Assigned: | 2016-12-23 | ||||||||||||||||||||
| Published: | 2016-12-23 | ||||||||||||||||||||
| Updated: | 2018-10-21 | ||||||||||||||||||||
| Summary: | The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address. | ||||||||||||||||||||
| CVSS v3 Severity: | 9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 8.8 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
8.8 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
| ||||||||||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||
| Vulnerability Type: | CWE-77 | ||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-10034 Source: CCN Type: SECTRACK ID: 1037539 Zend Framework Input Validation Flaw in zend-mail Lets Remote Users Execute Arbitrary Code on the Target System Source: BID Type: Third Party Advisory, VDB Entry 95144 Source: CCN Type: BID-95144 Zend Framework 'zend-mail' Component Remote Code Execution Vulnerability Source: SECTRACK Type: UNKNOWN 1037539 Source: XF Type: UNKNOWN zend-cve201610034-code-exec(120212) Source: CCN Type: Zend Framework Security Advisory ZF2016-04 Potential remote code execution in zend-mail via Sendmail adapter Source: CONFIRM Type: Exploit, Technical Description, Vendor Advisory https://framework.zend.com/security/advisory/ZF2016-04 Source: MISC Type: Exploit, Technical Description, Third Party Advisory https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html Source: GENTOO Type: UNKNOWN GLSA-201804-10 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [12-30-2016] Source: EXPLOIT-DB Type: UNKNOWN 40979 Source: EXPLOIT-DB Type: UNKNOWN 40986 Source: EXPLOIT-DB Type: UNKNOWN 42221 Source: CCN Type: WhiteSource Vulnerability Database CVE-2016-10034 | ||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
| BACK | |||||||||||||||||||||