The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.
References
Configurations
No configuration.
History
21 Nov 2024, 09:42
Type | Values Removed | Values Added |
---|---|---|
References | () https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290 - | |
References | () https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851 - | |
References | () https://www.twcert.org.tw/tw/cp-132-7769-0773a-1.html - |
03 Jul 2024, 21:15
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
|
References |
|
29 Apr 2024, 03:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-04-29 03:15
Updated : 2024-11-21 09:42
NVD link : CVE-2024-4298
Mitre link : CVE-2024-4298
CVE.ORG link : CVE-2024-4298
JSON object : View
Products Affected
No product.
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')