CVE-2023-24842

Summary

HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access partial content of another user’s mail by changing user ID and mail ID within URL.

Affected Software

VendorProductVersion RangeStatus
HGigaMailSherlockiSherlock-user-4.5 <= iSherlock-user-4.5-161affected
HGigaMailSherlockiSherlock-antispam-4.5 <= iSherlock-antispam-4.5-167affected

Weaknesses

  • CWE-639: CWE-639 Authorization Bypass Through User-Controlled Key

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References