PT-2019-9845 · Webgalamb · Webgalamb

Daniel Jones · Publicado 2019-03-17 · Atualizado 2019-03-22 · CVE-2018-19513

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Webgalamb versions prior to 7.0

Description The issue concerns the exposure of log files to the internet, potentially containing sensitive client data such as email addresses. This exposure also facilitates the exploitation of SQL injection errors. The log files are stored with predictable filenames, making them easily accessible.

Recommendations For versions prior to 7.0, restrict access to the log files to prevent exposure of sensitive data and potential exploitation of SQL injection errors. Consider implementing proper access controls and secure storage for log files until a fixed version is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2018-19513

Produtos afetados

Webgalamb

Referências · 4

• 🔥 http://seclists.org/fulldisclosure/2019/Jan/15 · Exploit
• 🔥 http://packetstormsecurity.com/files/151017/Webgalamb-Information-Disclosure-XSS-CSRF-SQL-Injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-19513 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19513 · Nota de Segurança