CVE-2024-4298

The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.
Configurations

No configuration.

History

21 Nov 2024, 09:42

Type Values Removed Values Added
References () https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290 - () https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290 -
References () https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851 - () https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851 -
References () https://www.twcert.org.tw/tw/cp-132-7769-0773a-1.html - () https://www.twcert.org.tw/tw/cp-132-7769-0773a-1.html -

03 Jul 2024, 21:15

Type Values Removed Values Added
Summary
  • (es) La interfaz de búsqueda de correo electrónico de HGiga iSherlock (incluidos MailSherlock, SpamSherock, AuditSherlock) no filtra caracteres especiales en ciertos parámetros de función, lo que permite a atacantes remotos con privilegios administrativos explotar esta vulnerabilidad para ataques de inyección de comandos, permitiendo la ejecución de comandos arbitrarios del sistema.
References
  • () https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290 -
  • () https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851 -

29 Apr 2024, 03:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-04-29 03:15

Updated : 2024-11-21 09:42


NVD link : CVE-2024-4298

Mitre link : CVE-2024-4298

CVE.ORG link : CVE-2024-4298


JSON object : View

Products Affected

No product.

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')