PT-2019-9501 · Mailsherlock · Mailsherlock

Publicado 2019-02-11 · Atualizado 2019-10-09 · CVE-2018-17542

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MailSherlock versions prior to 1.5.235

Description The issue allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise. This is achieved via the select mid parameter in an "letgo.cgi" request, which is vulnerable to SQL Injection.

Recommendations For versions prior to 1.5.235, update to version 1.5.235 or later to resolve the issue. As a temporary workaround, consider restricting access to the "letgo.cgi" request to minimize the risk of exploitation. Avoid using the select mid parameter in the affected request until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-17542

Produtos afetados

Mailsherlock

Referências · 4

• https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73 · Nota
• https://osv.dev/vulnerability/CVE-2018-17542 · Aviso do Fabricante
• https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=28 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-17542 · Nota de Segurança