PT-2022-7894 · Solare · Solare Solar-Log

T. Weber · Published 2022-06-09 · Updated 2022-06-17 · CVE-2017-20021

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Solare Solar-Log versions 2.8.4-56 through 3.5.2-85

Description A critical issue was found in the File Upload component, allowing for privilege escalation through remote attack. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions 2.8.4-56 through 3.5.2-85, upgrade to version 3.5.3-86 to address the issue. As a temporary workaround, consider restricting access to the File Upload component until the upgrade is applied.

Exploit

Fix

Improper Privilege Management

Unrestricted File Upload

Weakness Enumeration

CWE-269

CWE-434

Related Identifiers

CVE-2017-20021

Affected Products

Solare Solar-Log

References · 5

• 🔥 http://seclists.org/fulldisclosure/2017/Mar/58 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-20021 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20021 · Vendor Advisory
• https://vuldb.com/?id.98931 · Note
• https://t.me/cvenotify/31390 · Telegram Post