Lucene search

TwcertCVE-2020-35851

HistoryDec 31, 2020 - 8:15 a.m.

CVE-2020-35851

2020-12-3108:15:13

CWE-78

twcert

web.nvd.nist.gov

cve-2020-35851

hgiga mailsherlock

vulnerability

remote command injection

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.003

Percentile

68.1%

JSON

HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system.

Affected configurations

Nvd

Node

hgigamsr45_isherlock-userRange<4.5-115

hgigassr45_isherlock-userRange<4.5-115

VendorProductVersionCPE
hgigamsr45_isherlock-user*cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:*
hgigassr45_isherlock-user*cpe:2.3:a:hgiga:ssr45_isherlock-user:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hgiga	msr45_isherlock-user	*	cpe:2.3:a:hgiga:msr45_isherlock-user::::::::
hgiga	ssr45_isherlock-user	*	cpe:2.3:a:hgiga:ssr45_isherlock-user::::::::

CNA Affected

[
  {
    "platforms": [
      "iSherlock-user-4.5"
    ],
    "product": "MailSherlock MSR45/SSR45",
    "vendor": "HGiga",
    "versions": [
      {
        "lessThan": "115",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/en/cp-139-4264-f10f4-2.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.003

Percentile

68.1%

JSON

Related for CVE-2020-35851