Lucene search

[email protected]CVE-2019-9883

HistoryJun 03, 2019 - 6:29 p.m.

CVE-2019-9883

2019-06-0318:29:06

CWE-352

[email protected]

web.nvd.nist.gov

cve-2019-9883

mailsherlock

csrf

vulnerability

privilege escalation

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.8%

JSON

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.

Affected configurations

NVD

Node

hgigamsr35_isherlock-baseRange<1.5.328

hgigamsr35_isherlock-sysinfoRange<1.5.196

hgigamsr35_isherlock-userRange<1.5.127

hgigamsr35_isherlock-useradminRange<1.5.239

hgigamsr45_isherlock-baseRange<4.5-206

hgigamsr45_isherlock-sysinfoRange<4.5-109

hgigamsr45_isherlock-userRange<4.5-81

hgigamsr45_isherlock-useradminRange<4.5-106

CPENameOperatorVersion
hgiga:msr35_isherlock-basehgiga msr35 isherlock-baselt1.5.328
hgiga:msr35_isherlock-sysinfohgiga msr35 isherlock-sysinfolt1.5.196
hgiga:msr35_isherlock-userhgiga msr35 isherlock-userlt1.5.127
hgiga:msr35_isherlock-useradminhgiga msr35 isherlock-useradminlt1.5.239
hgiga:msr45_isherlock-basehgiga msr45 isherlock-baselt4.5-206
hgiga:msr45_isherlock-sysinfohgiga msr45 isherlock-sysinfolt4.5-109
hgiga:msr45_isherlock-userhgiga msr45 isherlock-userlt4.5-81
hgiga:msr45_isherlock-useradminhgiga msr45 isherlock-useradminlt4.5-106

CPE	Name	Operator	Version
hgiga:msr35_isherlock-base	hgiga msr35 isherlock-base	lt	1.5.328
hgiga:msr35_isherlock-sysinfo	hgiga msr35 isherlock-sysinfo	lt	1.5.196
hgiga:msr35_isherlock-user	hgiga msr35 isherlock-user	lt	1.5.127
hgiga:msr35_isherlock-useradmin	hgiga msr35 isherlock-useradmin	lt	1.5.239
hgiga:msr45_isherlock-base	hgiga msr45 isherlock-base	lt	4.5-206
hgiga:msr45_isherlock-sysinfo	hgiga msr45 isherlock-sysinfo	lt	4.5-109
hgiga:msr45_isherlock-user	hgiga msr45 isherlock-user	lt	4.5-81
hgiga:msr45_isherlock-useradmin	hgiga msr45 isherlock-useradmin	lt	4.5-106

CNA Affected

[
  {
    "product": "MailSherlock MSR35",
    "vendor": "OAKlouds ",
    "versions": [
      {
        "lessThan": "1.5-328",
        "status": "affected",
        "version": "iSherlock-base",
        "versionType": "custom"
      },
      {
        "lessThan": "1.5-239",
        "status": "affected",
        "version": "iSherlock-useradmin",
        "versionType": "custom"
      },
      {
        "lessThan": "1.5-196",
        "status": "affected",
        "version": "iSherlock-sysinfo",
        "versionType": "custom"
      },
      {
        "lessThan": "1.5-127",
        "status": "affected",
        "version": "iSherlock-user",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "MailSherlock MSR45",
    "vendor": "OAKlouds ",
    "versions": [
      {
        "lessThan": "4.5-206",
        "status": "affected",
        "version": "iSherlock-base",
        "versionType": "custom"
      },
      {
        "lessThan": "4.5-106",
        "status": "affected",
        "version": "iSherlock-useradmin",
        "versionType": "custom"
      },
      {
        "lessThan": "4.5-109",
        "status": "affected",
        "version": "iSherlock-sysinfo",
        "versionType": "custom"
      },
      {
        "lessThan": "4.5-81",
        "status": "affected",
        "version": "iSherlock-user",
        "versionType": "custom"
      }
    ]
  }
]

References

surl.twcert.org.tw/mChNi

tvn.twcert.org.tw/taiwanvn/TVN-201904003

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.8%

JSON

Related for CVE-2019-9883

prion1 cvelist1 nvd1