iSherlock Account Management Interface Vulnerability: Arbitrary File Download
CVE-2024-4296

4.9MEDIUM

Key Information:

Vendor

Hgiga

Status
Isherlock 4.5
Isherlock 5.5
Vendor
CVE Published:
29 April 2024

What is CVE-2024-4296?

The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.

Affected Version(s)

iSherlock 4.5 earlier < 149

iSherlock 5.5 earlier < 149

References

https://www.twcert.org.tw/tw/cp-132-7765-49906-1.html
third-party-advisory

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.