CVE-2024-4296mediumCWE-22

CVE-2024-4296: medium-severity vulnerability in HGiga iSherlock 4.5

HGiga iSherlock - Arbitrary File Download

Published · Updated

Follow this CVE+ Monitor iSherlock

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 0.7%
The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
HGiga · iSherlock 4.5HGiga · iSherlock 5.5
Related CVEs — HGiga iSherlock 4.5

In the same product, most dangerous first.

CVE-2024-4299HIGHHGiga iSherlock - Command InjectionEPSS 2.1%CVE-2024-4298HIGHHGiga iSherlock - Command InjectionEPSS 2.1%CVE-2025-11900CRITICALHGiga｜iSherlock - OS Command InjectionEPSS 1.8%CVE-2025-3363CRITICALHGiga iSherlock - OS Command InjectionEPSS 1.4%CVE-2025-3362CRITICALHGiga iSherlock - OS Command InjectionEPSS 1.4%CVE-2025-3361CRITICALHGiga iSherlock - OS Command InjectionEPSS 1.4%