CVE-2019-9883: Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account.

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-06-03 · updated 2026-06-17
Weakness: CWE-352

Description

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.

Affected products

HGiga Msr35 Isherlock-Base: before 1.5.328 — fixed in 1.5.328
HGiga Msr35 Isherlock-Sysinfo: before 1.5.196 — fixed in 1.5.196
HGiga Msr35 Isherlock-User: before 1.5.127 — fixed in 1.5.127
HGiga Msr35 Isherlock-Useradmin: before 1.5.239 — fixed in 1.5.239
HGiga Msr45 Isherlock-Base: before 4.5-206 — fixed in 4.5-206
HGiga Msr45 Isherlock-Sysinfo: before 4.5-109 — fixed in 4.5-109
HGiga Msr45 Isherlock-User: before 4.5-81 — fixed in 4.5-81
HGiga Msr45 Isherlock-Useradmin: before 4.5-106 — fixed in 4.5-106

How to fix

Upgrade to a fixed version: HGiga Msr35 Isherlock-Base 1.5.328; HGiga Msr35 Isherlock-Sysinfo 1.5.196; HGiga Msr35 Isherlock-User 1.5.127; HGiga Msr35 Isherlock-Useradmin 1.5.239; HGiga Msr45 Isherlock-Base 4.5-206; HGiga Msr45 Isherlock-Sysinfo 4.5-109; HGiga Msr45 Isherlock-User 4.5-81; HGiga Msr45 Isherlock-Useradmin 4.5-106. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-9883 or the next vulnerability affects your stack