Read the docs
TI-2019-07261 Aliases CVE-2019-9882GHSA-79pw-7m53-3xmf

Cross-site request forgery in HGiga MailSherlock MSR35

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.

Why it matters now

EPSS 0.00669 52nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed MailSherlock MSR35 (OAKlouds): 1.5-328, 1.5-239, 1.5-196 +1MailSherlock MSR45 (OAKlouds): 4.5-206, 4.5-106, 4.5-109 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HGigaMailSherlock MSR35iSherlock-base to before 1.5-328; iSherlock-useradmin to before 1.5-239; iSherlock-sysinfo to before 1.5-196; iSherlock-user to before 1.5-1271.5-328, 1.5-239, 1.5-196, 1.5-127Patch availableCNA
HGigaMailSherlock MSR45iSherlock-base to before 4.5-206; iSherlock-useradmin to before 4.5-106; iSherlock-sysinfo to before 4.5-109; iSherlock-user to before 4.5-814.5-206, 4.5-106, 4.5-109, 4.5-81Patch availableCNA
  • MailSherlock MSR35 VendorHGiga Affected iSherlock-base to before 1.5-328; iSherlock-useradmin to before 1.5-239; iSherlock-sysinfo to before 1.5-196; iSherlock-user to before 1.5-127 Fixed in 1.5-328, 1.5-239, 1.5-196, 1.5-127 Patch available CNA
  • MailSherlock MSR45 VendorHGiga Affected iSherlock-base to before 4.5-206; iSherlock-useradmin to before 4.5-106; iSherlock-sysinfo to before 4.5-109; iSherlock-user to before 4.5-81 Fixed in 4.5-206, 4.5-106, 4.5-109, 4.5-81 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:hgiga:msr35_isherlock-base:*:*:*:*:*:*:*:*before 1.5.328VulnerableHGiga
cpe:2.3:a:hgiga:msr35_isherlock-sysinfo:*:*:*:*:*:*:*:*before 1.5.196VulnerableHGiga
cpe:2.3:a:hgiga:msr35_isherlock-user:*:*:*:*:*:*:*:*before 1.5.127VulnerableHGiga
cpe:2.3:a:hgiga:msr35_isherlock-useradmin:*:*:*:*:*:*:*:*before 1.5.239VulnerableHGiga
cpe:2.3:a:hgiga:msr45_isherlock-base:*:*:*:*:*:*:*:*before 4.5-206VulnerableHGiga
cpe:2.3:a:hgiga:msr45_isherlock-sysinfo:*:*:*:*:*:*:*:*before 4.5-109VulnerableHGiga
cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:*before 4.5-81VulnerableHGiga
cpe:2.3:a:hgiga:msr45_isherlock-useradmin:*:*:*:*:*:*:*:*before 4.5-106VulnerableHGiga
  • cpe:2.3:a:hgiga:msr35_isherlock-base:*:*:*:*:*:*:*:* Versions before 1.5.328 Vulnerable ·HGiga
  • cpe:2.3:a:hgiga:msr35_isherlock-sysinfo:*:*:*:*:*:*:*:* Versions before 1.5.196 Vulnerable ·HGiga
  • cpe:2.3:a:hgiga:msr35_isherlock-user:*:*:*:*:*:*:*:* Versions before 1.5.127 Vulnerable ·HGiga
  • cpe:2.3:a:hgiga:msr35_isherlock-useradmin:*:*:*:*:*:*:*:* Versions before 1.5.239 Vulnerable ·HGiga
  • cpe:2.3:a:hgiga:msr45_isherlock-base:*:*:*:*:*:*:*:* Versions before 4.5-206 Vulnerable ·HGiga
  • cpe:2.3:a:hgiga:msr45_isherlock-sysinfo:*:*:*:*:*:*:*:* Versions before 4.5-109 Vulnerable ·HGiga
  • cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:* Versions before 4.5-81 Vulnerable ·HGiga
  • cpe:2.3:a:hgiga:msr45_isherlock-useradmin:*:*:*:*:*:*:*:* Versions before 4.5-106 Vulnerable ·HGiga

Remediation

  • Fix · CNA MailSherlock MSR35 (OAKlouds) Fixed in 1.5-328, 1.5-239, 1.5-196, 1.5-127
  • Fix · CNA MailSherlock MSR45 (OAKlouds) Fixed in 4.5-206, 4.5-106, 4.5-109, 4.5-81

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OAKlouds MailSherlock MSR35, MailSherlock MSR45 1.5-127, 1.5-196 and 6 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-07262 Cross-site request forgery in HGiga MailSherlock MSR35Priority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-9882
  2. 2026-10-03 Alias added: GHSA-79pw-7m53-3xmf

References

Exploit 2

  • TI-2019-07262 Cross-site request forgery in HGiga MailSherlock MSR35 CVSS 3.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences