CVE-2020-25848 HGiga MailSherlock - Broken Authentication

Critical 9.8 Published 31 Dec 2020 Updated 17 Sep 2024

Attackers can remotely gain privileges in HGiga MailSherlock due to a weak default password generation mechanism.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-25848?

CVE-2020-25848 is a critical authentication bypass vulnerability in HGiga MailSherlock MSR45/SSR45, published on 31 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.

Weakness: CWE-287

Which versions are affected by CVE-2020-25848?

It affects 10 products.

Products include Hgiga Msr45 Isherlock-Antispam, Hgiga Msr45 Isherlock-Audit, Hgiga Msr45 Isherlock-Base, Hgiga Msr45 Isherlock-User, Hgiga Msr45 Isherlock-Useradmin, Hgiga Ssr45 Isherlock-Antispam and 4 more.

How do I fix CVE-2020-25848?

No fix has been published for CVE-2020-25848 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-25848 being exploited?

There is no known exploitation of CVE-2020-25848 in the wild and no public exploit code.

Sources

Also known as GHSA-qf9m-hx8v-j382.