CVE-2019-9882
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.5-328, 1.5-239, 1.5-196, 1.5-127, 4.5-206, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.
Timeline
- CVE published
- Record last updated
Affected versions
- OAKlouds MailSherlock MSR35
From iSherlock-base · fixed in 1.5-328; From iSherlock-useradmin · fixed in 1.5-239; From iSherlock-sysinfo · fixed in 1.5-196; From iSherlock-user · fixed in 1.5-127
- OAKlouds MailSherlock MSR45
From iSherlock-base · fixed in 4.5-206; From iSherlock-useradmin · fixed in 4.5-106; From iSherlock-sysinfo · fixed in 4.5-109; From iSherlock-user · fixed in 4.5-81