PT-2019-9845 · Webgalamb · Webgalamb

Daniel Jones · Published 2019-03-17 · Updated 2019-03-22 · CVE-2018-19513

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Webgalamb versions prior to 7.0

Description The issue concerns the exposure of log files to the internet, potentially containing sensitive client data such as email addresses. This exposure also facilitates the exploitation of SQL injection errors. The log files are stored with predictable filenames, making them easily accessible.

Recommendations For versions prior to 7.0, restrict access to the log files to prevent exposure of sensitive data and potential exploitation of SQL injection errors. Consider implementing proper access controls and secure storage for log files until a fixed version is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2018-19513

Affected Products

Webgalamb

References · 4

• 🔥 http://seclists.org/fulldisclosure/2019/Jan/15 · Exploit
• 🔥 http://packetstormsecurity.com/files/151017/Webgalamb-Information-Disclosure-XSS-CSRF-SQL-Injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-19513 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19513 · Security Note