CVE-2019-9882

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.

N/A

Published: June 3, 2019 at 06:03 PM UTC

Updated: June 17, 2026 at 02:44 AM UTC

10 products affected across 2 vendorsMSR45 Isherlock UserMSR45 Isherlock UseradminMSR45 Isherlock Base

Using MailSherlock MSR35 by OAKlouds?

Get instant alerts when new vulnerabilities affect MailSherlock MSR35 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 0.7%

Description

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

MSR35 Isherlock Base · Hgiga

95%

v < 1.5.328

Affected range stops below 1.5.328, so it looks safe — our inference, not a vendor statement

MSR35 Isherlock Sysinfo · Hgiga

95%

v < 1.5.196

Affected range stops below 1.5.196, so it looks safe — our inference, not a vendor statement

MSR35 Isherlock User · Hgiga

95%

v < 1.5.127

Affected range stops below 1.5.127, so it looks safe — our inference, not a vendor statement

MSR35 Isherlock Useradmin · Hgiga

95%

v < 1.5.239

Affected range stops below 1.5.239, so it looks safe — our inference, not a vendor statement

MSR45 Isherlock Base · Hgiga

95%

v < 4.5-206

Affected range stops below 4.5-206, so it looks safe — our inference, not a vendor statement

MSR45 Isherlock Sysinfo · Hgiga

95%

v < 4.5-109

Affected range stops below 4.5-109, so it looks safe — our inference, not a vendor statement

MSR45 Isherlock User · Hgiga

95%

v < 4.5-81

Affected range stops below 4.5-81, so it looks safe — our inference, not a vendor statement

MSR45 Isherlock Useradmin · Hgiga

95%

v < 4.5-106

Affected range stops below 4.5-106, so it looks safe — our inference, not a vendor statement

MailSherlock MSR35 · Oaklouds

60%

iSherlock-base ≤ v < 1.5-328iSherlock-sysinfo ≤ v < 1.5-196iSherlock-user ≤ v < 1.5-127iSherlock-useradmin ≤ v < 1.5-239iSherlock-base iSherlock-sysinfo iSherlock-user iSherlock-useradmin

Affected range stops below 1.5-127, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.5-196, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.5-239, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.5-328, so it looks safe — our inference, not a vendor statement

MailSherlock MSR45 · Oaklouds

60%

iSherlock-base ≤ v < 4.5-206iSherlock-sysinfo ≤ v < 4.5-109iSherlock-user ≤ v < 4.5-81iSherlock-useradmin ≤ v < 4.5-106iSherlock-base iSherlock-sysinfo iSherlock-user iSherlock-useradmin

Affected range stops below 4.5-106, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5-109, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5-206, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5-81, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

x_refsource_MISCExploitThird Party Advisory

Source: [email protected]

http://surl.twcert.org.tw/MtWeJ

x_refsource_MISCExploitThird Party Advisory

Source: [email protected]

https://tvn.twcert.org.tw/taiwanvn/TVN-201904002

CVSS

6.8MEDIUM[email protected]

Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-352

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card