CVE-2023-24839: HGiga MailSherlock - Reflected XSS

Description

HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript, conducting a reflected XSS attack.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 42% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

MA

MailSherlock · HGiga

iSherlock-user-4.5 through iSherlock-user-4.5-161; iSherlock-antispam-4.5 through iSherlock-antispam-4.5-167 · source: vendor

OM

Oaklouds Mailsherlock · Hgiga

4.5 · source: NVD