CVE-2019-9883
03.06.2019, 18:29
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.
| Vendor | Product | Version |
|---|---|---|
| hgiga | msr35_isherlock-base | 𝑥 < 1.5.328 |
| hgiga | msr35_isherlock-sysinfo | 𝑥 < 1.5.196 |
| hgiga | msr35_isherlock-user | 𝑥 < 1.5.127 |
| hgiga | msr35_isherlock-useradmin | 𝑥 < 1.5.239 |
| hgiga | msr45_isherlock-base | 𝑥 < 4.5-206 |
| hgiga | msr45_isherlock-sysinfo | 𝑥 < 4.5-109 |
| hgiga | msr45_isherlock-user | 𝑥 < 4.5-81 |
| hgiga | msr45_isherlock-useradmin | 𝑥 < 4.5-106 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration