CVE-2019-9882

🗓️ 03 Jun 2019 18:03:21Reported by twcertType

cve🔗 web.nvd.nist.gov👁 64 Views🌐 WEB

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attackers to add malicious email sources into whitelist without authorization

Reporter	Title	Published	Views	Family All 5
Cvelist	CVE-2019-9882 Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.	3 Jun 201918:03	–	cvelist
EUVD	EUVD-2019-19238	7 Oct 202500:30	–	euvd
NVD	CVE-2019-9882	3 Jun 201918:29	–	nvd
Prion	Cross site request forgery (csrf)	3 Jun 201918:29	–	prion
RedhatCVE	CVE-2019-9882	22 May 202509:18	–	redhatcve

NVD

Vulners

Node

hgiga msr35_isherlock-baseRange<1.5.328

hgiga msr35_isherlock-sysinfoRange<1.5.196

hgiga msr35_isherlock-userRange<1.5.127

hgiga msr35_isherlock-useradminRange<1.5.239

hgiga msr45_isherlock-baseRange<4.5-206

hgiga msr45_isherlock-sysinfoRange<4.5-109

hgiga msr45_isherlock-userRange<4.5-81

hgiga msr45_isherlock-useradminRange<4.5-106

[
  {
    "product": "MailSherlock MSR35",
    "vendor": "OAKlouds",
    "versions": [
      {
        "lessThan": "1.5-328",
        "status": "affected",
        "version": "iSherlock-base",
        "versionType": "custom"
      },
      {
        "lessThan": "1.5-239",
        "status": "affected",
        "version": "iSherlock-useradmin",
        "versionType": "custom"
      },
      {
        "lessThan": "1.5-196",
        "status": "affected",
        "version": "iSherlock-sysinfo",
        "versionType": "custom"
      },
      {
        "lessThan": "1.5-127",
        "status": "affected",
        "version": "iSherlock-user",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "MailSherlock MSR45",
    "vendor": "OAKlouds",
    "versions": [
      {
        "lessThan": "4.5-206",
        "status": "affected",
        "version": "iSherlock-base",
        "versionType": "custom"
      },
      {
        "lessThan": "4.5-106",
        "status": "affected",
        "version": "iSherlock-useradmin",
        "versionType": "custom"
      },
      {
        "lessThan": "4.5-109",
        "status": "affected",
        "version": "iSherlock-sysinfo",
        "versionType": "custom"
      },
      {
        "lessThan": "4.5-81",
        "status": "affected",
        "version": "iSherlock-user",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
surl	www.surl.twcert.org.tw/MtWeJ
tvn	www.tvn.twcert.org.tw/taiwanvn/TVN-201904002

Parameter	Position	Path	Description	CWE
ACSION	query param	user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E	CSRF vulnerability allowing unauthenticated attacker to add malicious email sources into whitelist.	CWE-352
type	query param	user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E	CSRF vulnerability allowing unauthenticated attacker to add malicious email sources into whitelist.	CWE-352
category	query param	user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E	CSRF vulnerability allowing unauthenticated attacker to add malicious email sources into whitelist.	CWE-352
locate	query param	user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E	CSRF vulnerability allowing unauthenticated attacker to add malicious email sources into whitelist.	CWE-352
cmd	query param	user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E	CSRF vulnerability allowing unauthenticated attacker to add malicious email sources into whitelist.	CWE-352
new	query param	user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E	CSRF vulnerability allowing unauthenticated attacker to add malicious email sources into whitelist.	CWE-352
new_memo	query param	user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E	CSRF vulnerability allowing unauthenticated attacker to add malicious email sources into whitelist.	CWE-352
add	query param	user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E	CSRF vulnerability allowing unauthenticated attacker to add malicious email sources into whitelist.	CWE-352

21 Nov 2024 04:52Current

8.7High risk

Vulners AI Score8.7

CVSS 26.8

CVSS 38.8

EPSS0.00145

CWE-352