CVE:CVE-2019-9883
CNNVD:CNNVD-201906-010
MailSherlock是一套企业邮件审核系统。
MailSherlock MSR35和MSR45中存在跨站请求伪造漏洞。该漏洞源于WEB应用未充分验证请求是否来自可信用户。攻击者可利用该漏洞通过受影响客户端向服务器发送非预期的请求。
solution:Upgrade hgiga msr35_isherlock-base to a higher version than 1.5.328,and avoid the version (,1.5.328); Upgrade hgiga msr35_isherlock-sysinfo to a higher version than 1.5.196,and avoid the version (,1.5.196); Upgrade hgiga msr35_isherlock-user to a higher version than 1.5.127,and avoid the version (,1.5.127); Upgrade hgiga msr35_isherlock-useradmin to a higher version than 1.5.239,and avoid the version (,1.5.239); Upgrade hgiga msr45_isherlock-base to a higher version than 4.5-206,and avoid the version (,4.5-206); Upgrade hgiga msr45_isherlock-sysinfo to a higher version than 4.5-109,and avoid the version (,4.5-109); Upgrade hgiga msr45_isherlock-user to a higher version than 4.5-81,and avoid the version (,4.5-81); Upgrade hgiga msr45_isherlock-useradmin to a higher version than 4.5-106,and avoid the version (,4.5-106)