PT-2020-17796 · Ultralog · Ultralog Express

Alan Chung · Published 2020-03-27 · Updated 2024-09-17 · CVE-2020-3920

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions UltraLog Express (affected versions not specified)

Description The UltraLog Express device management interface has an issue with access authentication on certain pages or functions. This allows any user to access a privileged page for managing accounts by navigating through a specific system directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-3920

Affected Products

Ultralog Express

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-3920 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3920 · Vendor Advisory
• https://twcert.org.tw/tw/cp-132-3452-937d6-1.html · Note
• https://t.me/cvenotify/2212 · Telegram Post
• https://t.me/cvenotify/94863 · Telegram Post
• https://t.me/cvenotify/79206 · Telegram Post