CVE-2024-4296

MEDIUM

HGiga iSherlock 4.5-4.5-149 - Authenticated Path Traversal via Account Management Interface

Title source: llm

Description

The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.

References (1)

Core 1

Core References

Third Party Advisory third-party-advisory

https://www.twcert.org.tw/tw/cp-132-7765-49906-1.html

Scores

CVSS v3 4.9

EPSS 0.0067

EPSS Percentile 47.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-22

Status published

Products (1)

hgiga/isherlock 4.5 - 4.5-149

Published Apr 29, 2024

Tracked Since Feb 18, 2026