CVE Request: PHPMailer Message Injection Vulnerability

[Gsunde Orangen <gsunde.orangen () gmail com>]

Given the widespread use of PHPMailer I believe this merits a CVE ID:

> From https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14:

"Takeshi Terada discovered that PHPMailer accepted addresses containing
line breaks. This is valid in RFC5322, but allowing such addresses
resulted in invalid RFC5321 SMTP commands, permitting a kind of message
injection attack. These addresses were allowed by the pcre8 validator
pattern (the default in recent PHP versions).
This has been mitigated by rejecting line breaks during address
validation, and also by rejecting line breaks in SMTP commands, which
addresses the problem for applications using the SMTP class directly."

Fixed in PHPMailer 5.2.14

My (non-authoritative) guess for a CVSSv3 score:
Base Score: 3.7 (Low)
Temporal Score: 3.2 (Low)
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C

Thanks,
Gsunde