CVE-2020-25848

HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcertCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
VendorProductVersion
hgigamsr45_isherlock-antispam
𝑥
< 4.5-130
hgigamsr45_isherlock-audit
𝑥
< 4.5-143
hgigamsr45_isherlock-base
𝑥
< 4.5-243
hgigamsr45_isherlock-user
𝑥
< 4.5-114
hgigamsr45_isherlock-useradmin
𝑥
< 4.5-122
hgigassr45_isherlock-antispam
𝑥
< 4.5-130
hgigassr45_isherlock-audit
𝑥
< 4.5-143
hgigassr45_isherlock-base
𝑥
< 4.5-243
hgigassr45_isherlock-user
𝑥
< 4.5-114
hgigassr45_isherlock-useradmin
𝑥
< 4.5-112
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html
https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html