« Volver al listado

CVE-2020-35740

Estado: ModificadaMedia (6.1)—

HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Hgiga — Msr45 Isherlock-antispamHgiga — Msr45 Isherlock-userHgiga — Ssr45 Isherlock-antispamHgiga — Ssr45 Isherlock-user

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-35740",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "HGiga",
          "product": "MailSherlock MSR45/SSR45",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "120",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "iSherlock-user-4.5"
          ]
        },
        {
          "vendor": "HGiga",
          "product": "MailSherlock MSR45/SSR45",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "133",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "iSherlock-antispam-4.5"
          ]
        }
      ]
    }
  ],
  "published": "2020-12-31T08:15:13.550",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks."
    },
    {
      "lang": "es",
      "value": "HGiga MailSherlock no comprueba apropiadamente los parámetros URL específicos que permiten a atacantes inyectar la sintaxis de JavaScript para ataques de tipo XSS."
    }
  ],
  "lastModified": "2026-06-17T03:14:13.420",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hgiga:msr45_isherlock-antispam:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E5B5E25-BC65-49E2-9865-9BC9A4DE98F0",
              "versionEndExcluding": "4.5-133"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F203F7FA-9E30-49AD-956C-5E893B1264A4",
              "versionEndExcluding": "4.5-120"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:ssr45_isherlock-antispam:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAAA3F24-7821-4F5A-A64E-EEA30B269DD2",
              "versionEndExcluding": "4.5-133"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:ssr45_isherlock-user:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE0FEDEB-2C43-4C45-800A-9323146DC214",
              "versionEndExcluding": "4.5-120"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}