CVE-2019-9883: Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account.
First published: Mon Jun 03 2019(Updated: )
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.
Credit: twcert@cert.org.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hgiga Msr35 Isherlock-base | <1.5.328 | |
| Hgiga Msr35 Isherlock-sysinfo | <1.5.196 | |
| Hgiga Msr35 Isherlock-user | <1.5.127 | |
| Hgiga Msr35 Isherlock-useradmin | <1.5.239 | |
| Hgiga Msr45 Isherlock-base | <4.5-206 | |
| Hgiga Msr45 Isherlock-sysinfo | <4.5-109 | |
| Hgiga Msr45 Isherlock-user | <4.5-81 | |
| Hgiga Msr45 Isherlock-useradmin | <4.5-106 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this CSRF vulnerability?
The vulnerability ID of this CSRF vulnerability is CVE-2019-9883.
What is the severity of CVE-2019-9883?
The severity of CVE-2019-9883 is high, with a severity value of 8.8.
What software is affected by CVE-2019-9883?
The MailSherlock MSR35 and MSR45 modules are affected by CVE-2019-9883.
How can an attacker exploit CVE-2019-9883?
An attacker can exploit CVE-2019-9883 by using the useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= endpoint to elevate the privilege of a specific account without any authorization.
Is there a fix available for CVE-2019-9883?
It is recommended to update to the latest versions of the affected MailSherlock MSR35 and MSR45 modules to address CVE-2019-9883.
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/title
- agent/author
- agent/weakness
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/description
- agent/tags
- agent/source
- vendor/hgiga
- canonical/hgiga msr35 isherlock-base
- canonical/hgiga msr35 isherlock-sysinfo
- canonical/hgiga msr35 isherlock-user
- canonical/hgiga msr35 isherlock-useradmin
- canonical/hgiga msr45 isherlock-base
- canonical/hgiga msr45 isherlock-sysinfo
- canonical/hgiga msr45 isherlock-user
- canonical/hgiga msr45 isherlock-useradmin