HGiga MailSherlock - Reflected XSS
CVE-2023-24839

6.1MEDIUM

Key Information:

Vendor

Hgiga

Status
Mailsherlock
Vendor
CVE Published:
27 March 2023

What is CVE-2023-24839?

HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript, conducting a reflected XSS attack.

Affected Version(s)

MailSherlock iSherlock-user-4.5

MailSherlock iSherlock-antispam-4.5

References

https://www.twcert.org.tw/tw/cp-132-6958-e1a8e-1.html

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.