PT-2020-10404 · Elog · Elog

Published 2020-01-10 · Updated 2020-01-14 · CVE-2019-20375

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ELOG version 3.1.4

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the value parameter in a localization (loc) command to elogd.c.

Recommendations For ELOG version 3.1.4, update to a version that fixes this issue, as using the value parameter in the localization command poses a risk of code injection. As a temporary workaround, consider restricting access to the localization command until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20375

Affected Products

Elog

References · 3

• https://bitbucket.org/ritt/elog/commits/eefdabb714f26192f585083ef96c8413e459a1d1 · Patch
• https://osv.dev/vulnerability/CVE-2019-20375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20375 · Security Note