Vulnerability · Published Jan 5, 2021 · Assigned by mitre
CVE-2020-35488
High 7.5
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.6% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.)
Affected products (as reported)
References
- https://github.com/GuillaumePetit84/CVE-2020-35488 x_refsource_MISC
- https://gitlab.com/nxlog-public/nxlog-ce/-/blob/master/ChangeLog.txt#L2 x_refsource_MISC