PT-2021-20853 · Unknown · Kiwi Syslog Server

Published 2021-10-25 · Updated 2021-10-28 · CVE-2021-35231

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Kiwi Syslog Server (affected versions not specified)

Description: The issue is related to an unquoted service path vulnerability in the Kiwi Syslog Server Installation Wizard. This vulnerability allows a local attacker to gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. An example of a vulnerable path is "ComputerHKEY LOCAL MACHINESYSTEMControlSet001ServicesKiwi Syslog ServerParametersApplication".

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2021-35231

Affected Products

Kiwi Syslog Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-35231 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35231 · Vendor Advisory
• https://solarwinds.com/trust-center/security-advisories/cve-2021-35231 · Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm · Vendor Advisory
• https://t.me/cvenotify/22327 · Telegram Post
• https://t.me/cvenotify/22597 · Telegram Post