jvndb-2021-000007
Vulnerability from jvndb
Published
2021-01-27 18:31
Modified
2022-07-26 15:53
Severity ?
Summary
OS command injection vulnerability in multiple Infoscience Corporation log management tools
Details
Infoscience Corporation's multiple log management tools provide an FTP upload function as one of the log collection methods, and is able to set to allow the adminitrators to accept FTP uploads.
In a situation where the FTP upload function is enabled and there is a flaw of input value handling in the log processing, a remote attacker who can upload a crafted log via FTP may execute an arbitrary OS command on the server where the products are running (CWE-78).
Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| ▼ | Type | URL |
|---|---|---|
| JVN | https://jvn.jp/en/jp/JVN41853173/index.html | |
| CVE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5626 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2020-5626 | |
| OS Command Injection(CWE-78) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| Infoscience | ELC Analytics | |
| Infoscience | Logstorage |
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000007.html",
"dc:date": "2022-07-26T15:53+09:00",
"dcterms:issued": "2021-01-27T18:31+09:00",
"dcterms:modified": "2022-07-26T15:53+09:00",
"description": "Infoscience Corporation\u0027s multiple log management tools provide an FTP upload function as one of the log collection methods, and is able to set to allow the adminitrators to accept FTP uploads.\r\nIn a situation where the FTP upload function is enabled and there is a flaw of input value handling in the log processing, a remote attacker who can upload a crafted log via FTP may execute an arbitrary OS command on the server where the products are running (CWE-78).\r\n\r\nTaizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000007.html",
"sec:cpe": [
{
"#text": "cpe:/a:infoscience:elc_analytics",
"@product": "ELC Analytics",
"@vendor": "Infoscience",
"@version": "2.2"
},
{
"#text": "cpe:/a:infoscience:logstorage",
"@product": "Logstorage",
"@vendor": "Infoscience",
"@version": "2.2"
}
],
"sec:cvss": [
{
"@score": "7.1",
"@severity": "High",
"@type": "Base",
"@vector": "AV:N/AC:H/Au:S/C:C/I:C/A:C",
"@version": "2.0"
},
{
"@score": "7.5",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2021-000007",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN41853173/index.html",
"@id": "JVN#41853173",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5626",
"@id": "CVE-2020-5626",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5626",
"@id": "CVE-2020-5626",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
}
],
"title": "OS command injection vulnerability in multiple Infoscience Corporation log management tools"
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.