CVE-2024-4299: HGiga iSherlock - Command Injection
First published: Mon Apr 29 2024(Updated: )
The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.
Credit: twcert@cert.org.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HGiga iSherlock | ||
| HGiga MailSherlock | ||
| HGiga SpamSherock | ||
| HGiga AuditSherlock |
Remedy
Update the iSherlock-sysinfo package to version 4.5-147 or later for iSherlock 4.5, and to version 5.5-147 or later for iSherlock 5.5.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4299?
CVE-2024-4299 is classified with a high severity due to its potential for command injection by attackers with administrative privileges.
How do I fix CVE-2024-4299?
To mitigate CVE-2024-4299, ensure that input validation is implemented to filter special characters in the affected system configuration interfaces.
Which products are affected by CVE-2024-4299?
CVE-2024-4299 affects HGiga iSherlock, MailSherlock, SpamSherock, and AuditSherlock software.
Who can exploit CVE-2024-4299?
CVE-2024-4299 can be exploited by remote attackers who possess administrative privileges on the affected systems.
What attack vector does CVE-2024-4299 utilize?
CVE-2024-4299 utilizes command injection as the primary attack vector, taking advantage of insufficient input sanitization.
- agent/weakness
- agent/remedy
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/references
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/hgiga
- canonical/hgiga isherlock
- canonical/hgiga mailsherlock
- canonical/hgiga spamsherock
- canonical/hgiga auditsherlock