Medium severity · published Dec 31, 2020
CVE-2020-35741
HGiga MailSherlock does not validate user parameters on multiple login pages
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Msr45 Isherlock-antispam · Hgiga
before 4.5-133 · source: NVD
MI
Msr45 Isherlock-user · Hgiga
before 4.5-120 · source: NVD
SI
Ssr45 Isherlock-antispam · Hgiga
before 4.5-133 · source: NVD
SI
Ssr45 Isherlock-user · Hgiga
before 4.5-120 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-35741
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-35741
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html
More from Msr45 Isherlock-antispam
9.8
CVE-2021-22848
HGiga MailSherlock contains a SQL Injection
9.8
CVE-2020-25848
HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism
7.6
CVE-2020-35743
HGiga MailSherlock contains a SQL injection flaw
7.6
CVE-2020-35742
HGiga MailSherlock contains a vulnerability of SQL Injection
6.1
CVE-2020-35740
HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks