CVE-2020-35851 HGiga MailSherlock - Command Injection
Remote attackers can execute arbitrary system commands on HGiga MailSherlock servers due to improper parameter validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-35851?
CVE-2020-35851 is a high-severity command injection vulnerability in HGiga MailSherlock MSR45/SSR45, published on 31 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system.
Weakness: CWE-78
Which versions are affected by CVE-2020-35851?
It affects 2 products.
Products include Hgiga Msr45 Isherlock-User, Hgiga Ssr45 Isherlock-User.
How do I fix CVE-2020-35851?
No fix has been published for CVE-2020-35851 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-35851 being exploited?
There is no known exploitation of CVE-2020-35851 in the wild and no public exploit code.
Other vulnerabilities in HGiga MailSherlock MSR45/SSR45
Sources
Also known as GHSA-f62f-7p64-pmrv.