title: HGiga MailSherlock - Command Injection
description: HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service.
problem types: CWE-78 OS Command Injection
affected:
{
vendor: HGiga
product: MailSherlock
versions:
version: iSherlock-sysinfo-4.5, status: affected, lessThanOrEqual: iSherlock-sysinfo-4.5-132, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
]
solutions: Update MailSherlock package version to iSherlock-sysinfo-4.5-133.386