PT-2020-15943 · Logrhythm · Logrhythm Platform Manager

Published 2020-12-17 · Updated 2020-12-21 · CVE-2020-25095

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LogRhythm Platform Manager version 7.4.9

Description The LogRhythm Platform Manager is vulnerable to Cross-site Request Forgery (CSRF) and Cross-site WebSocket Hijacking (CSWH). If a logged-in user visits a malicious site in the same browser session, that site can perform a CSRF attack to create a WebSocket from the victim client to the vulnerable server. Once the socket is created, the malicious site can interact with the vulnerable web server in the context of the logged-in user, potentially resulting in command execution.

Recommendations For LogRhythm Platform Manager version 7.4.9, consider disabling WebSocket functionality until a patch is available to prevent potential command execution. Restrict access to the web interface to minimize the risk of exploitation. Avoid using the same browser session for both the LogRhythm Platform Manager and other potentially malicious sites.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-25095

Affected Products

Logrhythm Platform Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-25095 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25095 · Vendor Advisory
• https://t.me/cvenotify/7445 · Telegram Post
• https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days · Note
• https://t.me/cibsecurity/20979 · Telegram Post