TI-2020-18197 Aliases CVE-2020-35741 GHSA-6w7j-r535-gc2c

HGiga MailSherlock - XSS -2

LOW 32CWE-79Published 2020-12-31 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks.

Why it matters now

EPSS 0.00619 49th percentileScored 2026-11-07

Fix Fixed MailSherlock MSR45/SSR45 (HGiga): 120, 133

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HGiga	MailSherlock MSR45/SSR45	before 120	120	Patch available	CNA
HGiga	MailSherlock MSR45/SSR45	before 133	133	Patch available	CNA

MailSherlock MSR45/SSR45 VendorHGiga Affected before 120 Fixed in 120 Patch available CNA
MailSherlock MSR45/SSR45 VendorHGiga Affected before 133 Fixed in 133 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:hgiga:msr45_isherlock-antispam::::::::	before 4.5-133	Vulnerable	HGiga
cpe:2.3:a:hgiga:msr45_isherlock-user::::::::	before 4.5-120	Vulnerable	HGiga
cpe:2.3:a:hgiga:ssr45_isherlock-antispam::::::::	before 4.5-133	Vulnerable	HGiga
cpe:2.3:a:hgiga:ssr45_isherlock-user::::::::	before 4.5-120	Vulnerable	HGiga

cpe:2.3:a:hgiga:msr45_isherlock-antispam:*:*:*:*:*:*:*:* Versions before 4.5-133 Vulnerable ·HGiga
cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:* Versions before 4.5-120 Vulnerable ·HGiga
cpe:2.3:a:hgiga:ssr45_isherlock-antispam:*:*:*:*:*:*:*:* Versions before 4.5-133 Vulnerable ·HGiga
cpe:2.3:a:hgiga:ssr45_isherlock-user:*:*:*:*:*:*:*:* Versions before 4.5-120 Vulnerable ·HGiga

Remediation

Fix · CNA MailSherlock MSR45/SSR45 (HGiga) Fixed in 120
Fix · CNA MailSherlock MSR45/SSR45 (HGiga) Fixed in 133

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2020-12-31
HGiga MailSherlock MSR45/SSR45 120, 133
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2020-18199 HGiga MailSherlock - SQL Injection -3Priority LOW 34
- TI-2020-18198 HGiga MailSherlock - SQL Injection -1Priority LOW 34
- TI-2020-18196 HGiga MailSherlock - XSS -1Priority LOW 32
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2020-35741
2026-10-03 Alias added: GHSA-6w7j-r535-gc2c

References

Advisory 1

https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html

TI-2020-15839 HGiga MailSherlock - Broken Authentication CVSS 3.1CRITICAL 9.8
TI-2021-05709 HGiga MailSherlock - SQL Injection-2 CVSS 3.1CRITICAL 9.8
TI-2020-18199 HGiga MailSherlock - SQL Injection -3 CVSS 3.1HIGH 7.6
TI-2020-18198 HGiga MailSherlock - SQL Injection -1 CVSS 3.1HIGH 7.6
TI-2020-18196 HGiga MailSherlock - XSS -1 CVSS 3.1HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences