HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Msr45_isherlock-antispam | Hgiga | * | 4.5-130 (excluding) |
| Msr45_isherlock-audit | Hgiga | * | 4.5-143 (excluding) |
| Msr45_isherlock-base | Hgiga | * | 4.5-243 (excluding) |
| Msr45_isherlock-user | Hgiga | * | 4.5-114 (excluding) |
| Msr45_isherlock-useradmin | Hgiga | * | 4.5-122 (excluding) |
| Ssr45_isherlock-antispam | Hgiga | * | 4.5-130 (excluding) |
| Ssr45_isherlock-audit | Hgiga | * | 4.5-143 (excluding) |
| Ssr45_isherlock-base | Hgiga | * | 4.5-243 (excluding) |
| Ssr45_isherlock-user | Hgiga | * | 4.5-114 (excluding) |
| Ssr45_isherlock-useradmin | Hgiga | * | 4.5-112 (excluding) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html