CVEvulnerability

CVE-2024-4296

4.9 MEDIUM Published 2024-04-29 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-04-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22

Description

The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.

Affected configurations

• hgiga isherlock (>= 4.5 < 4.5-149) • hgiga isherlock (>= 5.5 < 5.5-149)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References