PT-2025-44664 · Elog · Elog

Published 2025-10-31 · Updated 2025-11-10 · CVE-2025-62618

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ELOG versions prior to 3.1.5-20251014

Description ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. The application includes usernames and password hashes in certain HTTP requests, potentially allowing an attacker to obtain credentials and replay them or crack the password hash offline.

Recommendations Update to ELOG version 3.1.5-20251014 or later.

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-836

CWE-79

CWE-434

Related Identifiers

CVE-2025-62618

Affected Products

Elog

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-62618 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62618 · Vendor Advisory
• https://bitbucket.org/ritt/elog/commits/7092ff64f6eb9521f8cc8c52272a020bf3730946 · Patch
• https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc · Patch
• https://cve.org/CVERecord?id=CVE-2025-62618 · Security Note
• https://elog.psi.ch/elog/download/RPMS/?C=M;O=D · Note
• https://twitter.com/CVEnew/status/1984337731171074297 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984406002708385838 · Twitter Post
• https://t.me/cveNotify/142314 · Telegram Post
• https://t.me/CVEtracker/36339 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-304-01.json · Note