CVE-2019-9883

Published: Jun 3, 2019Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.

Affected (8)

Products: Hgiga: Msr35 Isherlock Base, Msr35 Isherlock Sysinfo, Msr35 Isherlock User, Msr35 Isherlock Useradmin, Msr45 Isherlock Base, Msr45 Isherlock Sysinfo, Msr45 Isherlock User, Msr45 Isherlock Useradmin

Hgiga

8 products

Msr35 Isherlock Base

Msr35 Isherlock Sysinfo

Msr35 Isherlock User

Msr35 Isherlock Useradmin

Msr45 Isherlock Base

Msr45 Isherlock Sysinfo

Msr45 Isherlock User

Msr45 Isherlock Useradmin

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Hgiga Msr35 Isherlock Base	Before 1.5.328
Hgiga Msr35 Isherlock Sysinfo	Before 1.5.196
Hgiga Msr35 Isherlock User	Before 1.5.127
Hgiga Msr35 Isherlock Useradmin	Before 1.5.239
Hgiga Msr45 Isherlock Base	Before 4.5-206
Hgiga Msr45 Isherlock Sysinfo	Before 4.5-109
Hgiga Msr45 Isherlock User	Before 4.5-81
Hgiga Msr45 Isherlock Useradmin	Before 4.5-106