CVE-2024-4297
Assigner: twcert
Published: 2024-04-29T02:28:24.526Z
State: PUBLISHED
affected: defaultStatus: unaffected
modules: iSherlock-sysinfo
product: iSherlock 4.5
vendor: HGiga
versions: lessThan: 4.5-147
status: affected
version: earlier
versionType: custom
defaultStatus: unaffected
modules: iSherlock-sysinfo
product: iSherlock 5.5
vendor: HGiga
versions: lessThan: 5.5-147
status: affected
version: earlier
versionType: custom
datePublic: 2024-04-29T02:20:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.
value: The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.
impacts: capecId: CAPEC-139
descriptions: value: CAPEC-139 Relative Path Traversal
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Update the iSherlock-sysinfo package to version 4.5-147 or later for iSherlock 4.5, and to version 5.5-147 or later for iSherlock 5.5.
value: Update the iSherlock-sysinfo package to version 4.5-147 or later for iSherlock 4.5, and to version 5.5-147 or later for iSherlock 5.5.
source: advisory: TVN-202404008
discovery: UNKNOWN
title: HGiga iSherlock - Arbitrary File Download
x_generator: engine: Vulnogram 0.1.0-dev