Lucene search

[email protected]CVE-2020-35851

HistoryDec 31, 2020 - 8:15 a.m.

CVE-2020-35851

2020-12-3108:15:13

CWE-78

[email protected]

web.nvd.nist.gov

cve-2020-35851

hgiga mailsherlock

vulnerability

remote command injection

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.2%

JSON

HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system.

Affected configurations

NVD

Node

hgigamsr45_isherlock-userRange<4.5-115

hgigassr45_isherlock-userRange<4.5-115

CPENameOperatorVersion
hgiga:msr45_isherlock-userhgiga msr45 isherlock-userlt4.5-115
hgiga:ssr45_isherlock-userhgiga ssr45 isherlock-userlt4.5-115

CPE	Name	Operator	Version
hgiga:msr45_isherlock-user	hgiga msr45 isherlock-user	lt	4.5-115
hgiga:ssr45_isherlock-user	hgiga ssr45 isherlock-user	lt	4.5-115

CNA Affected

[
  {
    "platforms": [
      "iSherlock-user-4.5"
    ],
    "product": "MailSherlock MSR45/SSR45",
    "vendor": "HGiga",
    "versions": [
      {
        "lessThan": "115",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/en/cp-139-4264-f10f4-2.html

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.2%

JSON

Related for CVE-2020-35851

prion1 cvelist1 nvd1