CVE-2024-31845

MEDIUM Year: 2024
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-117
View all →

Vulnerability Description

An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is attributed to a different user. This can be exploited without authentication.

Related Vulnerabilities

CVE-2019-10213

MEDIUM
CVSS:5.3(Medium)

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read...

CWE-1172019

CVE-2019-14854

MEDIUM
CVSS:5.3(Medium)

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to d...

CWE-1172019

CVE-2020-4072

MEDIUM
CVSS:5.3(Medium)

In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forg...

CWE-1172020

CVE-2021-20333

MEDIUM
CVSS:5.3(Medium)

Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6...

CWE-1172021

CVE-2021-43410

MEDIUM
CVSS:5.3(Medium)

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affecte...

CWE-1172021

CVE-2022-1522

MEDIUM
CVSS:5.3(Medium)

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which allows an attacker to create false logs that...

CWE-1172022