PT-2021-24039 · Zrlog · Zrlog

1979139113 · Published 2021-11-28 · Updated 2021-11-29 · CVE-2021-44094

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ZrLog version 2.2.2

Description: The issue is related to a remote command execution vulnerability in the plugin download function. This vulnerability allows the execution of any JAR file.

Recommendations: For ZrLog version 2.2.2, as a temporary workaround, consider disabling the plugin download function until a patch is available. Restrict access to the plugin download module to minimize the risk of exploitation. Avoid using the vulnerable plugin download functionality in the affected ZrLog version until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-44094

Affected Products

Zrlog

References · 5

• 🔥 https://github.com/94fzb/zrlog/issues/116 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44094 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44094 · Vendor Advisory
• https://t.me/cvenotify/23901 · Telegram Post
• https://t.me/cvenotify/23856 · Telegram Post