Back to feed
EUVD-2019-19239 · Published Jun 3, 2019
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.
Technologies
Hgiga Msr45 Isherlock-UseradminHgiga Msr45 Isherlock-SysinfoHgiga Msr45 Isherlock-UserHgiga Msr35 Isherlock-SysinfoHgiga Msr35 Isherlock-BaseHgiga Msr35 Isherlock-UseradminHgiga Msr35 Isherlock-UserHgiga Msr45 Isherlock-Base
Weaknesses
CWE-352
CVSS scores
- v3.08.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - v2.06.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
Potentially impacted assets
See if this affects your attack surface
