CVE-2017-20187 describes a critical injection vulnerability in Magnesium-PHP up to version 0.3.0, specifically within the formatEmailString function in src/Magnesium/Message/Base.php, affecting products using this unsupported library. This flaw allows for injection by manipulating email/name arguments. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with no authentication or user interaction required, leading to high impact on confidentiality, integrity, and availability. The CWE-74 classification indicates improper neutralization of special elements in input. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 11 mentions, indicating awareness. Upgrading to Magnesium-PHP 0.3.1 is recommended to address this issue, though the affected product is no longer supported.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.3.0CPE matchmatch criteria | cpe:2.3:a:floriangaerber:magnesium-php:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.