CVE-2019-9883: Hgiga MSR35 Isherlock-Base

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.

Affected products

• Hgiga MSR35 Isherlock-Base: before 1.5.328 (fixed in 1.5.328)
• Hgiga MSR35 Isherlock-Sysinfo: before 1.5.196 (fixed in 1.5.196)
• Hgiga MSR35 Isherlock-User: before 1.5.127 (fixed in 1.5.127)
• Hgiga MSR35 Isherlock-Useradmin: before 1.5.239 (fixed in 1.5.239)
• Hgiga MSR45 Isherlock-Base: before 4.5-206 (fixed in 4.5-206)
• Hgiga MSR45 Isherlock-Sysinfo: before 4.5-109 (fixed in 4.5-109)
• Hgiga MSR45 Isherlock-User: before 4.5-81 (fixed in 4.5-81)
• Hgiga MSR45 Isherlock-Useradmin: before 4.5-106 (fixed in 4.5-106)

Published 2019-06-03. Last modified 2026-06-17.