CVE-2019-9882 Cross-site request forgery in MailSherlock MSR35
Attackers can exploit CSRF to add malicious email sources to the whitelist in MailSherlock MSR35 and MSR45 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-9882?
CVE-2019-9882 is a high-severity vulnerability in OAKlouds MailSherlock MSR35, published on 3 Jun 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.
Weakness: CWE-352
Which versions are affected by CVE-2019-9882?
It affects 8 products.
Products include Hgiga Msr35 Isherlock-Base, Hgiga Msr35 Isherlock-Sysinfo, Hgiga Msr35 Isherlock-User, Hgiga Msr35 Isherlock-Useradmin, Hgiga Msr45 Isherlock-Base, Hgiga Msr45 Isherlock-Sysinfo and 2 more.
How do I fix CVE-2019-9882?
No fix has been published for CVE-2019-9882 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-9882 being exploited?
There is no known exploitation of CVE-2019-9882 in the wild and no public exploit code.
Other vulnerabilities in OAKlouds MailSherlock MSR35
Sources
Also known as GHSA-79pw-7m53-3xmf.