title: HGiga MailSherlock - Broken Authentication
description: HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.
problem types: Broken Authentication
affected:
{
platforms: iSherlock-base-4.5
product: MailSherlock MSR45/SSR45
vendor: HGiga
versions:
lessThan: 243, status: affected, version: unspecified, versionType: custom
}
{
platforms: iSherlock-user-4.5
product: MailSherlock MSR45/SSR45
vendor: HGiga
versions:
lessThan: 114, status: affected, version: unspecified, versionType: custom
}
{
platforms: iSherlock-useradmin-4.5
product: MailSherlock MSR45/SSR45
vendor: HGiga
versions:
lessThan: 122, status: affected, version: unspecified, versionType: custom
}
{
platforms: iSherlock-audit-4.5
product: MailSherlock MSR45/SSR45
vendor: HGiga
versions:
lessThan: 143, status: affected, version: unspecified, versionType: custom
}
{
platforms: iSherlock-antispam-4.5
product: MailSherlock MSR45/SSR45
vendor: HGiga
versions:
lessThan: 130, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Update MailSherlock MSR45/SSR45 Module to:
iSherlock-base-4.5-243.i386.rpm
iSherlock-user-4.5-114.i386.rpm
iSherlock-useradmin-4.5-122.i386.rpm
iSherlock-audit-4.5-143.i386.rpm
iSherlock-antispam-4.5-130.i386.rpm