| Package | Affected versions | Patched versions |
|---|---|---|
| msr35 isherlock-base | < 1.5.328 | 1.5.328 |
| msr35 isherlock-sysinfo | < 1.5.196 | 1.5.196 |
| msr35 isherlock-user | < 1.5.127 | 1.5.127 |
| msr35 isherlock-useradmin | < 1.5.239 | 1.5.239 |
| msr45 isherlock-base | < 4.5-206 | 4.5-206 |
| msr45 isherlock-sysinfo | < 4.5-109 | 4.5-109 |
| msr45 isherlock-user | < 4.5-81 | 4.5-81 |
| msr45 isherlock-useradmin | < 4.5-106 | 4.5-106 |
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&[email protected]&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free