CVE-2024-4297: HGiga iSherlock - Arbitrary File Download
First published: Mon Apr 29 2024(Updated: )
The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.
Credit: twcert@cert.org.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HGiga iSherlock | ||
| HGiga MailSherlock | ||
| HGiga SpamSherlock | ||
| HGiga AuditSherlock |
Remedy
Update the iSherlock-sysinfo package to version 4.5-147 or later for iSherlock 4.5, and to version 5.5-147 or later for iSherlock 5.5.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4297?
CVE-2024-4297 is considered a critical vulnerability due to its potential to allow remote attackers with administrative privileges to exploit the system.
How do I fix CVE-2024-4297?
To fix CVE-2024-4297, administrators should update the affected HGiga iSherlock, MailSherlock, SpamSherlock, and AuditSherlock software to the latest patched versions.
Which products are affected by CVE-2024-4297?
CVE-2024-4297 affects HGiga iSherlock, MailSherlock, SpamSherlock, and AuditSherlock software products.
What is the exploit method for CVE-2024-4297?
CVE-2024-4297 can be exploited by sending specially crafted requests that include unfiltered special characters to the system configuration interface.
Who can exploit CVE-2024-4297?
CVE-2024-4297 can be exploited by remote attackers who possess administrative privileges on the affected systems.
- agent/weakness
- agent/remedy
- agent/references
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/hgiga
- canonical/hgiga isherlock
- canonical/hgiga mailsherlock
- canonical/hgiga spamsherlock
- canonical/hgiga auditsherlock