CVE-2019-9883

PoC ×2—

CVSS 3.0

8.8 high

EPSS

<1%p50

Published

Jun 3, 2019 (Jun 3, 2019)

Modified

Jun 17, 2026

Description

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.

Vendors: hgiga
Products: msr35 isherlock-base, msr35 isherlock-sysinfo, msr35 isherlock-user, msr35 isherlock-useradmin, msr45 isherlock-base, msr45 isherlock-sysinfo, msr45 isherlock-user, msr45 isherlock-useradmin
Weakness: CWE-352
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.