CVE-2012-0796

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-07-17 · updated 2026-06-16
Weakness: CWE-94

Description

class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.

Affected products

Moodle: 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.9.5, 1.9.6 (+21)

References

http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=62988bf0bbc73df655f51884aaf1f523928abff9
http://moodle.org/mod/forum/discuss.php?d=194015
http://www.debian.org/security/2012/dsa-2421
https://bugzilla.redhat.com/show_bug.cgi?id=783532
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=62988bf0bbc73df655f51884aaf1f523928abff9
http://moodle.org/mod/forum/discuss.php?d=194015
http://www.debian.org/security/2012/dsa-2421
https://bugzilla.redhat.com/show_bug.cgi?id=783532

Get alerted when CVE-2012-0796 or the next vulnerability affects your stack