CVE-2017-20187

Magnesium-PHP Base.php formatEmailString injection

3.5 LowFix available

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3.1 is able to address this issue. The patch is identified as 500d340e1f6421007413cc08a8383475221c2604. It is recommended to upgrade the affected component. VDB-244482 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.69%Up 0.6 points since Nov 6, 2023

What each source reports

CVE List Score used 3.5

Magnesium-PHP Base.php formatEmailString injection

Record: CVE-2017-20187
CVSS 3.1: 3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 3.0: 3.5 LowCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 2.7 AV:A/AC:L/Au:S/C:N/I:P/A:N
Weakness: CWE-74
Updated: 2026-11-02

EUVDEUVD-2023-2929 3.5

Record: EUVD-2023-2929
CVSS 3.1: 3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8pp6-5qpw-85g3 3.5

Magnesium-PHP Injection vulnerability

** UNSUPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3.1 is able to address this issue. The patch is identified as 500d340e1f6421007413cc08a8383475221c2604. It is recommended to upgrade the affected component. VDB-244482 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Record: GHSA-8pp6-5qpw-85g3
CVSS 3.0: 3.5 LowCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-74
Updated: 2026-11-02

NVD 3.5

Record: CVE-2017-20187
CVSS 3.1: 3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 2.7 LowAV:A/AC:L/Au:S/C:N/I:P/A:N
Weakness: CWE-74
Updated: 2026-11-02

OSV 9.8

Record: CVE-2017-20187
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-8pp6-5qpw-85g3 3.5

Magnesium-PHP Injection vulnerability

Record: GHSA-8pp6-5qpw-85g3
CVSS 3.0: 3.5 LowCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-74
Updated: 2026-11-02

Affected products

floriangaerber magnesium-php

Affected packages

Affected packages
Package	Affected	Fixed
`floriangaerber/magnesium` Packagist	before 0.3.1	0.3.1
`floriangaerber/magnesium` Packagist	before 0.3.1, plus listed versions v0.1.0v0.2.0v0.3.0	0.3.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-20187 is a low vulnerability (CVSS 3.5) in Floriangaerber Magnesium-php, published November 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 52nd percentile. Fixed in floriangaerber/magnesium 0.3.1.