CVE-2024-4298

Опубликовано: 29 апр. 2024

Источник: nvd

CVSS3: 7.2

EPSS Низкий

Описание

The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.

Ссылки

https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290
Third Party Advisory
https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7769-0773a-1.html
Third Party Advisory
https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290
Third Party Advisory
https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7769-0773a-1.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:hgiga:isherlock:*:*:*:*:*:*:*:*

Версия от 4.5 (включая) до 4.5-188 (исключая)

cpe:2.3:a:hgiga:isherlock:*:*:*:*:*:*:*:*

Версия от 5.5 (включая) до 5.5-188 (исключая)

EPSS

Процентиль: 84%

0.02199

Низкий

7.2 High

CVSS3

Дефекты

CWE-78

Связанные уязвимости

GHSA-8mvv-2pq8-4996