CVE-2019-9882: Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-06-03 · updated 2026-06-17
Weakness: CWE-352

Description

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.

Affected products

HGiga Msr35 Isherlock-Base: before 1.5.328 — fixed in 1.5.328
HGiga Msr35 Isherlock-Sysinfo: before 1.5.196 — fixed in 1.5.196
HGiga Msr35 Isherlock-User: before 1.5.127 — fixed in 1.5.127
HGiga Msr35 Isherlock-Useradmin: before 1.5.239 — fixed in 1.5.239
HGiga Msr45 Isherlock-Base: before 4.5-206 — fixed in 4.5-206
HGiga Msr45 Isherlock-Sysinfo: before 4.5-109 — fixed in 4.5-109
HGiga Msr45 Isherlock-User: before 4.5-81 — fixed in 4.5-81
HGiga Msr45 Isherlock-Useradmin: before 4.5-106 — fixed in 4.5-106

How to fix

Upgrade to a fixed version: HGiga Msr35 Isherlock-Base 1.5.328; HGiga Msr35 Isherlock-Sysinfo 1.5.196; HGiga Msr35 Isherlock-User 1.5.127; HGiga Msr35 Isherlock-Useradmin 1.5.239; HGiga Msr45 Isherlock-Base 4.5-206; HGiga Msr45 Isherlock-Sysinfo 4.5-109; HGiga Msr45 Isherlock-User 4.5-81; HGiga Msr45 Isherlock-Useradmin 4.5-106. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-9882 or the next vulnerability affects your stack