SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2002-0986

The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."

MEDIUM 5.0EPSS 4.70%

Does this matter?

Lower severity and a low EPSS score (4.70%). Track it; it rarely justifies an emergency change on its own.

Description

The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."

CVSS 2.0
5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS
4.70% probability · 91th percentile
CISA KEV
Not listed
Affected
php/php
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.