PT-2024-11776 · Logpoint · Logpoint

Timo Fahlenbock · Published 2024-04-27 · Updated 2024-07-03 · CVE-2022-48685

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:H/S:C/UI:R

Name of the Vulnerable Software and Affected Versions Logpoint versions 7.1 through 7.1.1 Logpoint version 7.1.2 is not affected, so the range can be simplified to versions prior to 7.1.2.

Description An issue was discovered in Logpoint where the daily executed cron file clean secbi old logs is writable by all users and is executed as root, leading to privilege escalation.

Recommendations For Logpoint versions prior to 7.1.2, update to version 7.1.2 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the clean secbi old logs cron file to prevent it from being writable by all users until a patch is applied.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-48685

Affected Products

Logpoint

References · 4

• https://osv.dev/vulnerability/CVE-2022-48685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48685 · Security Note
• https://servicedesk.logpoint.com/hc/en-us/articles/7997112373277-Privilege-Escalation-Through-Cronjob · Vendor Advisory
• https://t.me/cvenotify/78258 · Telegram Post