title: HGiga MailSherlock - Arbitrary File Download
description: The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files.
problem types: Arbitrary File Download
affected:
{
platforms: iSherlock-user-4.5
product: MailSherlock MSR45/SSR45
vendor: HGiga
versions:
lessThan: 117, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-117.i386.rpm