PT-2025-44666 · Elog · Elog

Published 2025-10-31 · Updated 2025-11-10 · CVE-2025-64349

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ELOG (affected versions not specified)

Description The ELOG platform, an electronic logbook system, has an issue where an authenticated attacker with low privileges can modify another user's profile. Specifically, an attacker can alter a target user’s email address and then initiate a password reset to gain control of the account. The system, by default, does not allow self-registration. The affected API endpoint is not specified. The vulnerable parameter is the email address within a user's profile. The modifyUserProfile() function is implicated in this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-64349

Affected Products

Elog

References · 12

• https://cve.org/CVERecord?id=CVE-2025-64349 · Security Note
• https://bitbucket.org/ritt/elog/commits/7092ff64f6eb9521f8cc8c52272a020bf3730946 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-64349 · Security Note
• https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc · Patch
• https://osv.dev/vulnerability/CVE-2025-64349 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1984344597112254824 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984400883199746051 · Twitter Post
• https://twitter.com/CVEnew/status/1984337729384312870 · Twitter Post
• https://t.me/cveNotify/142316 · Telegram Post
• https://t.me/CVEtracker/36343 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-304-01.json · Note
• https://twitter.com/CveTodo/status/1984341815374303463 · Twitter Post