CVE-2019-9883
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.5-328, 1.5-239, 1.5-196, 1.5-127, 4.5-206, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.
Timeline
- CVE published
- Record last updated
Affected versions
- OAKlouds MailSherlock MSR35
From iSherlock-base · fixed in 1.5-328; From iSherlock-useradmin · fixed in 1.5-239; From iSherlock-sysinfo · fixed in 1.5-196; From iSherlock-user · fixed in 1.5-127
- OAKlouds MailSherlock MSR45
From iSherlock-base · fixed in 4.5-206; From iSherlock-useradmin · fixed in 4.5-106; From iSherlock-sysinfo · fixed in 4.5-109; From iSherlock-user · fixed in 4.5-81