CVE-2019-9882
Last modified
CVE-2019-9882 is a vulnerability of currently unknown severity. Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.. EPSS estimates a 0.67% chance of exploitation in the next 30 days.
Description
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hgiga | Msr35 Isherlock-Base | < 1.5.328 |
| Hgiga | Msr35 Isherlock-Sysinfo | < 1.5.196 |
| Hgiga | Msr35 Isherlock-User | < 1.5.127 |
| Hgiga | Msr35 Isherlock-Useradmin | < 1.5.239 |
| Hgiga | Msr45 Isherlock-Base | < 4.5-206 |
| Hgiga | Msr45 Isherlock-Sysinfo | < 4.5-109 |
| Hgiga | Msr45 Isherlock-User | < 4.5-81 |
| Hgiga | Msr45 Isherlock-Useradmin | < 4.5-106 |
References
- http://surl.twcert.org.tw/MtWeJExploit, Third Party Advisory
- https://tvn.twcert.org.tw/taiwanvn/TVN-201904002Exploit, Third Party Advisory
- http://surl.twcert.org.tw/MtWeJExploit, Third Party Advisory
- https://tvn.twcert.org.tw/taiwanvn/TVN-201904002Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-9882?
How severe is CVE-2019-9882?
How do I fix CVE-2019-9882?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-9875Deserialization of Untrusted Data in the anti CSRF module in…8.8
- CVE-2019-9877There is an invalid memory access vulnerability in the funct…
- CVE-2019-9878There is an invalid memory access in the function GfxIndexed…
- CVE-2019-9879The WPGraphQL 0.2.3 plugin for WordPress allows remote attac…
- CVE-2019-9880An issue was discovered in the WPGraphQL 0.2.3 plugin for Wo…
- CVE-2019-9881The createComment mutation in the WPGraphQL 0.2.3 plugin for…
- CVE-2019-9883Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF…
- CVE-2019-9884eClass platform < ip.2.5.10.2.1 allows an attacker to use GE…9.8
- CVE-2019-9885eClass platform < ip.2.5.10.2.1 allows an attacker to execut…9.8
- CVE-2019-9886Any URLs with download_attachment.php under templates or hom…7.5
- CVE-2019-9889In Vanilla before 2.6.4, a flaw exists within the getSingleI…
- CVE-2019-9890An issue was discovered in GitLab Community and Enterprise E…
Are you affected by CVE-2019-9882?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST