{"id":"CVE-2024-4297","state":"PUBLISHED","title":"HGiga iSherlock - Arbitrary File Download","description":"The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.","publishedAt":"2024-04-29T02:28:24.526Z","updatedAt":"2025-07-14T02:17:55.601Z","severity":{"score":4.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","source":"twcert"},"assigner":"twcert","products":["HGiga iSherlock 4.5","HGiga iSherlock 5.5"],"affected":[{"vendor":"HGiga","product":"iSherlock 4.5","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"147","versionType":"custom"}],"modules":["iSherlock-sysinfo-4.5"]},{"vendor":"HGiga","product":"iSherlock 5.5","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"147","versionType":"custom"}],"modules":["iSherlock-sysinfo-5.5"]}],"references":["https://www.twcert.org.tw/tw/cp-132-7767-ce3b4-1.html"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/4xxx/CVE-2024-4297.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-4297","state":"PUBLISHED","datePublished":"2024-04-29T02:28:24.526Z","dateUpdated":"2025-07-14T02:17:55.601Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2024-04-29T01:47:07.589Z"},"containers":{"cna":{"title":"HGiga iSherlock - Arbitrary File Download","descriptions":[{"lang":"en","value":"The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files."}],"affected":[{"vendor":"HGiga","product":"iSherlock 4.5","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"147","versionType":"custom"}],"modules":["iSherlock-sysinfo-4.5"]},{"vendor":"HGiga","product":"iSherlock 5.5","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"147","versionType":"custom"}],"modules":["iSherlock-sysinfo-5.5"]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7767-ce3b4-1.html","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2025-07-14T02:17:55.601Z"},"datePublic":"2024-04-29T02:20:00.000Z","impacts":[{"capecId":"CAPEC-139","descriptions":[{"lang":"en","value":"CAPEC-139 Relative Path Traversal"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update iSherlock-sysinfo-4.5 to version 147 or later<br>\n\nUpdate iSherlock-sysinfo-5.5 to version 147 or later\n\n<br>"}],"value":"Update iSherlock-sysinfo-4.5 to version 147 or later\n\n\nUpdate iSherlock-sysinfo-5.5 to version 147 or later"}],"source":{"advisory":"TVN-202404008","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"hgiga","product":"isherlock","defaultStatus":"unknown","versions":[{"version":"4.5","status":"affected","lessThan":"4.5-147","versionType":"custom"}],"cpes":["cpe:2.3:a:hgiga:isherlock:4.5:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-4297","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-29T14:46:04.177828Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:53:11.281Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7767-ce3b4-1.html","tags":["third-party-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:33:53.076Z"}}]}}}