CVE-2019-9882: Hgiga MSR35 Isherlock-Base

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.

Affected products

• Hgiga MSR35 Isherlock-Base: before 1.5.328 (fixed in 1.5.328)
• Hgiga MSR35 Isherlock-Sysinfo: before 1.5.196 (fixed in 1.5.196)
• Hgiga MSR35 Isherlock-User: before 1.5.127 (fixed in 1.5.127)
• Hgiga MSR35 Isherlock-Useradmin: before 1.5.239 (fixed in 1.5.239)
• Hgiga MSR45 Isherlock-Base: before 4.5-206 (fixed in 4.5-206)
• Hgiga MSR45 Isherlock-Sysinfo: before 4.5-109 (fixed in 4.5-109)
• Hgiga MSR45 Isherlock-User: before 4.5-81 (fixed in 4.5-81)
• Hgiga MSR45 Isherlock-Useradmin: before 4.5-106 (fixed in 4.5-106)

Published 2019-06-03. Last modified 2026-06-17.