Lucene search

TwcertCVELIST:CVE-2021-22848

HistoryMar 18, 2021 - 12:00 a.m.

CVE-2021-22848 HGiga MailSherlock - SQL Injection-2

2021-03-1800:00:00

CWE-89

twcert

www.cve.org

hgiga mailsherlock

sql injection

remote attackers

email pages

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

AI Score

Confidence

High

EPSS

0.001

Percentile

46.4%

JSON

HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege.

CNA Affected

[
  {
    "product": "MailSherlock MSR45/SSR45",
    "vendor": "HGiga",
    "versions": [
      {
        "lessThan": "120",
        "status": "affected",
        "version": "iSherlock-user-4.5",
        "versionType": "custom"
      },
      {
        "lessThan": "133",
        "status": "affected",
        "version": "iSherlock-antispam-4.5",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-4521-a4fd8-1.html

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

AI Score

Confidence

High

EPSS

0.001

Percentile

46.4%

JSON

Related for CVELIST:CVE-2021-22848