CVE-2024-4297

MEDIUM

HGiga iSherlock 4.5-4.5-147 - Authenticated Path Traversal via System Configuration Interface

Title source: llm

Description

The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.

References (1)

Core 1

Core References

Third Party Advisory third-party-advisory

https://www.twcert.org.tw/tw/cp-132-7767-ce3b4-1.html

Scores

CVSS v3 4.9

EPSS 0.0067

EPSS Percentile 47.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (1)

hgiga/isherlock 4.5 - 4.5-147

Published Apr 29, 2024

Tracked Since Feb 18, 2026