1. Home
  2. CVE Database
  3. CVE-2018-17542
MEDIUM · 4.3

CVE-2018-17542

SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter ...

Vulnerability Description

SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.

CVSS Score

4.3

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
HgigaOaklouds Mailsherlock< 1.5.235

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2018-17542?

CVE-2018-17542 is a vulnerability with a CVSS score of 4.3 (MEDIUM). SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter ...

How severe is CVE-2018-17542?

CVE-2018-17542 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-17542?

Check the references section above for vendor advisories and patch information. Affected products include: Hgiga Oaklouds Mailsherlock.