CVE-2019-9882: Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.
First published: Mon Jun 03 2019(Updated: )
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.
Credit: twcert@cert.org.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hgiga Msr35 Isherlock-base | <1.5.328 | |
| Hgiga Msr35 Isherlock-sysinfo | <1.5.196 | |
| Hgiga Msr35 Isherlock-user | <1.5.127 | |
| Hgiga Msr35 Isherlock-useradmin | <1.5.239 | |
| Hgiga Msr45 Isherlock-base | <4.5-206 | |
| Hgiga Msr45 Isherlock-sysinfo | <4.5-109 | |
| Hgiga Msr45 Isherlock-user | <4.5-81 | |
| Hgiga Msr45 Isherlock-useradmin | <4.5-106 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2019-9882?
CVE-2019-9882 is a CSRF vulnerability found in multiple modules of MailSherlock MSR35 and MSR45.
What is the severity of CVE-2019-9882?
CVE-2019-9882 has a severity rating of 8.8 out of 10 (high).
How does CVE-2019-9882 work?
CVE-2019-9882 allows attackers to add malicious email sources into the whitelist without any authentication.
What software versions are affected by CVE-2019-9882?
CVE-2019-9882 affects the following software versions: Hgiga Msr35 Isherlock-base up to version 1.5.328, Hgiga Msr35 Isherlock-sysinfo up to version 1.5.196, Hgiga Msr35 Isherlock-user up to version 1.5.127, Hgiga Msr35 Isherlock-useradmin up to version 1.5.239, Hgiga Msr45 Isherlock-base up to version 4.5-206, Hgiga Msr45 Isherlock-sysinfo up to version 4.5-109, Hgiga Msr45 Isherlock-user up to version 4.5-81, and Hgiga Msr45 Isherlock-useradmin up to version 4.5-106.
How can I fix CVE-2019-9882?
To fix CVE-2019-9882, it is recommended to apply the latest patches and updates provided by MailSherlock.
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/title
- agent/author
- agent/weakness
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/description
- agent/tags
- agent/source
- vendor/hgiga
- canonical/hgiga msr35 isherlock-base
- canonical/hgiga msr35 isherlock-sysinfo
- canonical/hgiga msr35 isherlock-user
- canonical/hgiga msr35 isherlock-useradmin
- canonical/hgiga msr45 isherlock-base
- canonical/hgiga msr45 isherlock-sysinfo
- canonical/hgiga msr45 isherlock-user
- canonical/hgiga msr45 isherlock-useradmin