CVE-2019-9883 Cross-site request forgery in MailSherlock MSR35
A CSRF vulnerability in MailSherlock MSR35 and MSR45 allows attackers to elevate privileges of specific accounts without authorization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-9883?
CVE-2019-9883 is a high-severity vulnerability in OAKlouds MailSherlock MSR35, published on 3 Jun 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.
Weakness: CWE-352
Which versions are affected by CVE-2019-9883?
It affects 8 products.
Products include Hgiga Msr35 Isherlock-Base, Hgiga Msr35 Isherlock-Sysinfo, Hgiga Msr35 Isherlock-User, Hgiga Msr35 Isherlock-Useradmin, Hgiga Msr45 Isherlock-Base, Hgiga Msr45 Isherlock-Sysinfo and 2 more.
How do I fix CVE-2019-9883?
No fix has been published for CVE-2019-9883 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-9883 being exploited?
There is no known exploitation of CVE-2019-9883 in the wild and no public exploit code.
Other vulnerabilities in OAKlouds MailSherlock MSR35
Sources
Also known as GHSA-84r5-qw8f-pr73.