CVE-2020-35740: HGiga MailSherlock - XSS -1

Q: What is CVE-2020-35740?

CVE-2020-35740 is a vulnerability in the HGiga MailSherlock software that allows attackers to inject JavaScript syntax for XSS attacks.

Q: What is the severity of CVE-2020-35740?

CVE-2020-35740 has a severity level of 6.1 (high).

Q: Which software versions are affected by CVE-2020-35740?

Versions up to and excluding 4.5-133 of Hgiga Msr45 Isherlock-antispam and Hgiga Ssr45 Isherlock-antispam, and versions up to and excluding 4.5-120 of Hgiga Msr45 Isherlock-user and Hgiga Ssr45 Isherlock-user are affected.

Q: How can attackers exploit CVE-2020-35740?

Attackers can exploit CVE-2020-35740 by injecting JavaScript syntax through specific URL parameters.

Q: How can I fix CVE-2020-35740?

To fix CVE-2020-35740, it is recommended to apply the latest patches or updates provided by HGiga for the affected software versions.

Published Dec 31, 2020

Updated

HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.

Affected Software

4 affected components

Hgiga Msr45 Isherlock-antispam<4.5-133

Hgiga Msr45 Isherlock-user<4.5-120

Hgiga Ssr45 Isherlock-antispam<4.5-133

Hgiga Ssr45 Isherlock-user<4.5-120

Remediation

Information

Update MailSherlock MSR45/SSR45 Module to: iSherlock-user-4.5-120.i386.rpm iSherlock-antispam-4.5-133.i386.rpm

Event History

Dec 31, 2020

CVE Published

via MITRE·07:45 AM

Data Sourced

via MITRE·07:45 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-35740?

CVE-2020-35740 is a vulnerability in the HGiga MailSherlock software that allows attackers to inject JavaScript syntax for XSS attacks.

What is the severity of CVE-2020-35740?