{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000007.html",
  "dc:date": "2022-07-26T15:53+09:00",
  "dcterms:issued": "2021-01-27T18:31+09:00",
  "dcterms:modified": "2022-07-26T15:53+09:00",
  "description": "Infoscience Corporation\u0027s multiple log management tools provide an FTP upload function as one of the log collection methods, and is able to set to allow the adminitrators to accept FTP uploads.\r\nIn a situation where the FTP upload function is enabled and there is a flaw of input value handling in the log processing, a remote attacker who can upload a crafted log via FTP may execute an arbitrary OS command on the server where the products are running (CWE-78).\r\n\r\nTaizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000007.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:infoscience:elc_analytics",
      "@product": "ELC Analytics",
      "@vendor": "Infoscience",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:infoscience:logstorage",
      "@product": "Logstorage",
      "@vendor": "Infoscience",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "7.1",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:S/C:C/I:C/A:C",
      "@version": "2.0"
    },
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000007",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN41853173/index.html",
      "@id": "JVN#41853173",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5626",
      "@id": "CVE-2020-5626",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5626",
      "@id": "CVE-2020-5626",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "OS command injection vulnerability in multiple Infoscience Corporation log management tools"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:39:25.686Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.logstorage.com/support/vulnerability_info.html#jvn-41853173"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN41853173/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Logstorage and ELC Analytics",
          "vendor": "Infoscience Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier allow remote attackers to execute arbitrary OS commands via a specially crafted log file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OS Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-28T10:00:27",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.logstorage.com/support/vulnerability_info.html#jvn-41853173"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN41853173/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5626",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Logstorage and ELC Analytics",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Infoscience Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier allow remote attackers to execute arbitrary OS commands via a specially crafted log file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.logstorage.com/support/vulnerability_info.html#jvn-41853173",
              "refsource": "MISC",
              "url": "https://www.logstorage.com/support/vulnerability_info.html#jvn-41853173"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN41853173/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN41853173/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5626",
    "datePublished": "2021-01-28T10:00:28",
    "dateReserved": "2020-01-06T00:00:00",
    "dateUpdated": "2024-08-04T08:39:25.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}