PT-2019-4944 · Aria2+2 · Aria2+2
Dhiraj Mishra
·
Publicado
2019-01-01
·
Atualizado
2024-06-15
·
CVE-2019-3500
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
aria2 version 1.33.1
Description
The issue is related to the aria2c component in the aria2 utility, which can lead to information disclosure through log files. When the --log option is used, aria2c can store an HTTP Basic Authentication
username and password in a file. This might allow local users to obtain sensitive information by reading this file. The exploitation of this issue may allow an attacker to gain unauthorized access to protected information.Recommendations
For aria2 version 1.33.1, consider disabling the --log option to prevent sensitive information from being stored in log files until a fix is available. Restrict access to log files generated by aria2c to minimize the risk of exploitation. Avoid using the
username and password in the affected log files until the issue is resolved.Correção
Insertion into Log File
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Suse
Ubuntu
Aria2