CVE-2024-7564: Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability
First published: Tue Aug 06 2024(Updated: )
Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the get_response_json_result endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-24680.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Logsign Unified SecOps Platform | =6.4.11 | |
| Logsign Unified SecOps Platform |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-7564?
CVE-2024-7564 is categorized as a high severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2024-7564?
To mitigate CVE-2024-7564, upgrade the Logsign Unified SecOps Platform to version 6.4.13 or later.
What systems are affected by CVE-2024-7564?
CVE-2024-7564 affects Logsign Unified SecOps Platform version 6.4.11.
What type of vulnerability is CVE-2024-7564?
CVE-2024-7564 is a directory traversal information disclosure vulnerability.
Is authentication required to exploit CVE-2024-7564?
Yes, authentication is required to exploit the CVE-2024-7564 vulnerability.
- agent/weakness
- agent/author
- agent/type
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-24-1021
- alias/ZDI-CAN-24680
- alias/CVE-2024-7564
- agent/references
- agent/description
- agent/softwarecombine
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/trending
- agent/tags
- agent/source
- vendor/logsign
- canonical/logsign unified secops platform
- version/logsign unified secops platform/6.4.11