CVE-2025-64348

Katalog CVE

CVSS 7.1 · High EPSS 0,32%

Kerentanan Missing Authorization pada elog project elog. Skor CVSS 3.1 7.1 (High) menurut CNA.

Deskripsi (NVD)

ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is specifically enabled with the "-x" command line flag, attackers could execute OS commands on the host machine. By default, ELOG is not configured to allow shell commands or self-registration.

Rincian

Terbit di NVD

31 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bitbucket.org/ritt/elog/commits/7092ff64f6eb9521f8cc8c52272a020bf3730946 patch
• https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc patch
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-304-01.json advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2025-64348 advisory pihak ketiga