CVE-2023-24842

Published Mar 27, 2023

Last updated 3 months ago

CVSS medium 5.3

Overview

Description: HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access partial content of another user’s mail by changing user ID and mail ID within URL.
Source: twcert@cert.org.tw
NVD status: Modified

Risk scores

CVSS 3.1

Type: Secondary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

twcert@cert.org.tw: CWE-639

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:hgiga:oaklouds_mailsherlock:4.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FB0A93EB-11BC-4634-A8E2-09EA403912B2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References