github - ghsa-wv77-666p-gm5q

GHSA-WV77-666P-GM5Q

Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37

Details

The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-25850"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-31T08:15:00Z",
    "severity": "HIGH"
  },
  "details": "The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files.",
  "id": "GHSA-wv77-666p-gm5q",
  "modified": "2022-05-24T17:37:37Z",
  "published": "2022-05-24T17:37:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25850"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2020-25850 (GCVE-0-2020-25850)

Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-16 20:36

Title

HGiga MailSherlock - Arbitrary File Download

Summary

The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Arbitrary File Download

Assigner

twcert

References

URL

Tags

https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	HGiga	MailSherlock MSR45/SSR45	Affected: unspecified , < 117 (custom)

Credits

Robin Tung, Dio Lin of CHT Security Co., Ltd.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:49:05.969Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "iSherlock-user-4.5"
          ],
          "product": "MailSherlock MSR45/SSR45",
          "vendor": "HGiga",
          "versions": [
            {
              "lessThan": "117",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
        }
      ],
      "datePublic": "2020-12-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Arbitrary File Download",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-31T07:45:49",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-117.i386.rpm"
        }
      ],
      "source": {
        "advisory": "TVN-202011003",
        "discovery": "EXTERNAL"
      },
      "title": "HGiga MailSherlock - Arbitrary File Download",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
          "ID": "CVE-2020-25850",
          "STATE": "PUBLIC",
          "TITLE": "HGiga MailSherlock - Arbitrary File Download"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MailSherlock MSR45/SSR45",
                      "version": {
                        "version_data": [
                          {
                            "platform": "iSherlock-user-4.5",
                            "version_affected": "\u003c",
                            "version_value": "117"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "HGiga"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Arbitrary File Download"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-117.i386.rpm"
          }
        ],
        "source": {
          "advisory": "TVN-202011003",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2020-25850",
    "datePublished": "2020-12-31T07:45:49.379478Z",
    "dateReserved": "2020-09-23T00:00:00",
    "dateUpdated": "2024-09-16T20:36:52.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-WV77-666P-GM5Q

CVE-2020-25850 (GCVE-0-2020-25850)

Tags

Sightings

Nomenclature