HGiga iSherlock Configuration Interface Vulnerability Allows Command Injection

CVE-2024-4299

What is CVE-2024-4299?

The system configuration interface of HGiga's iSherlock suite, inclusive of MailSherlock, SpamSherlock, and AuditSherlock, is susceptible to command injection attacks due to improper filtering of special characters in specific function parameters. This vulnerability allows remote attackers, possessing administrative access, to execute arbitrary system commands on affected systems. The potential for exploitation emphasizes the need for robust security measures and timely software updates to mitigate risks associated with unauthorized command execution.

References