CVE-2025-64349: ELOG user profile missing authorization
ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take control of the target account. By default, ELOG is not configured to allow self-registration.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64349?
CVE-2025-64349 has a high severity rating due to the potential for account takeover through unauthorized profile modifications.
How do I fix CVE-2025-64349?
To fix CVE-2025-64349, ensure that user profile modification permissions are correctly configured to restrict unauthorized changes.
Who is affected by CVE-2025-64349?
CVE-2025-64349 affects users of the ELOG software who have permissions to modify user profiles.
What can an attacker do with CVE-2025-64349?
An attacker with access to modify user profiles can change another user's email and potentially take over their account by requesting a password reset.
Is self-registration allowed by default in ELOG for CVE-2025-64349?
No, by default, ELOG is not configured to allow self-registration, which adds to the complexity of the vulnerability.