TVN ID	TVN-202404010
CVE ID	CVE-2024-4299
CVSS	7.2 (High) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products	Affected products and versions： HGiga iSherlock (including MailSherlock , SpamSherock, AuditSherlock) 4.5、5.5 Affected components： iSherlock 4.5：iSherlock-sysinfo < 4.5-147 iSherlock 5.5：iSherlock-sysinfo < 5.5-147
Description	The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.
Solution	Update the iSherlock-sysinfo package to version 4.5-147 or later for iSherlock 4.5, and to version 5.5-147 or later for iSherlock 5.5.
Credit	Dong-Jie Chen (CHT Security)
Public Date	2024-04-29