CVE-2018-17542: SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds
Published Feb 11, 2019
·Updated
SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the selectmid parameter in an letgo.cgi request.
Affected Software
1 affected component
Hgiga Oaklouds Mailsherlock<1.5.235
Remediation
Information
Update the software to the latest version.
Event History
Feb 11, 2019
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-17542?
CVE-2018-17542 is considered a high severity vulnerability due to its ability to allow unauthorized access to sensitive email subjects.
2
How do I fix CVE-2018-17542?
To fix CVE-2018-17542, you should upgrade to MailSherlock version 1.5.235 or later.
3
Who is affected by CVE-2018-17542?
Any users of MailSherlock versions prior to 1.5.235 are vulnerable to CVE-2018-17542.
4
What kind of attack is possible with CVE-2018-17542?
CVE-2018-17542 allows an attacker to exploit SQL injection to extract email subjects from other users' accounts.
5
Can CVE-2018-17542 be exploited remotely?
Yes, CVE-2018-17542 can be exploited by unauthenticated users remotely through crafted requests.