CVE-2024-4298highCWE-78

CVE-2024-4298: high-severity vulnerability in HGiga iSherlock 4.5

HGiga iSherlock - Command Injection

Published · Updated

Follow this CVE+ Monitor iSherlock

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 2.1%
The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
HGiga · iSherlock 4.5HGiga · iSherlock 5.5
Related CVEs — HGiga iSherlock 4.5

In the same product, most dangerous first.

CVE-2024-4299HIGHHGiga iSherlock - Command InjectionEPSS 2.1%CVE-2025-11900CRITICALHGiga｜iSherlock - OS Command InjectionEPSS 1.8%CVE-2025-3363CRITICALHGiga iSherlock - OS Command InjectionEPSS 1.4%CVE-2025-3362CRITICALHGiga iSherlock - OS Command InjectionEPSS 1.4%CVE-2025-3361CRITICALHGiga iSherlock - OS Command InjectionEPSS 1.4%CVE-2023-37292CRITICALHGiga iSherlock - Command InjectionEPSS 1.3%