Medium severity · published Feb 11, 2019
CVE-2018-17542
SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds
5.3
CVSS
1.2%
EPSS
No
On KEV
Description
SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MailSherlock · OAKlouds
before 1.5.235 · source: vendor
OM
Oaklouds Mailsherlock · Hgiga
before 1.5.235 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-17542
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-17542
Third Party Advisory
https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73
Third Party Advisory
https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=28