PT-2024-37354 · Phloc · Phloc Webscopes

Published 2024-06-25 · Updated 2025-12-30 · CVE-2024-6060

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions: Phloc Webscopes version 7.0.0

Description: An information disclosure issue allows local attackers with access to the log files to view logged HTTP requests that contain user passwords or other sensitive information.

Recommendations: For Phloc Webscopes version 7.0.0, consider restricting access to the log files to minimize the risk of exploitation. As a temporary workaround, review and remove any sensitive information from the log files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-6060

Affected Products

Phloc Webscopes

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-6060 · Security Note
• https://sonatype.com/security-advisories/cve-2024-6060 · Note
• https://t.me/cveNotify/147148 · Telegram Post
• https://sites.google.com/sonatype.com/vulnerabilities/cve-2024-6060 · Note
• https://twitter.com/0dayPublishing/status/2006031462949105720 · Twitter Post