PT-2020-15153 · Zrlog · Zrlog

Rank0 · Published 2020-08-25 · Updated 2020-09-03 · CVE-2020-19005

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions zrlog version 2.1.0

Description The issue concerns a permission check flaw. When an admin account is logged in, unauthorized users can directly download the database backup file.

Recommendations For zrlog version 2.1.0, consider restricting access to the database backup file until a patch is available. As a temporary workaround, review and strengthen permission checks to prevent unauthorized downloads.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-19005

Affected Products

Zrlog

References · 4

• https://github.com/94fzb/zrlog/commit/b2b4415e2e59b6f18b0a62b633e71c96d63c43ba · Patch
• https://osv.dev/vulnerability/CVE-2020-19005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-19005 · Security Note
• https://github.com/94fzb/zrlog/issues/48 · Note