Logo
Sign in
  1. Logpoint Service Desk
  2. Products Hub
  3. Product Security

Remote Code Execution while creating Report Templates

Avatar Kripa Thapa
February 04, 2025 08:41
Follow

Advisory ID: LVD-2024-013

CVSSv 4.0 Vector: AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CVSSv 4.0 Base Score: 7.5

Severity: High

CVE: CVE-2024-56086

CWE: CWE-77

Date Published: 2024-10-15

Description:

Authenticated users can inject malicious payloads in the Report Templates, which are executed when the backup process is initiated. This leads to Remote Code Execution.

Affected Product:

Logpoint versions prior to 7.5.0.

Solution:

Upgrade to Logpoint v7.5.0.

Acknowledgments:

Mehmet D. Ince

Sr. Vulnerability Researcher

Prodaft

Comments

Article is closed for comments.

Related articles

  • Remote Code Execution while creating Universal Normalizer
  • Server-Side Template Injection (SSTI) in Search Template Dashboard Queries
  • Static JWT Key enables unauthorized API access
  • Server-Side Template Injection (SSTI) in Search Template Dashboard
  • Vendor list changes are reset to default after upgrading to Logpoint v7.5.0.
Was this article helpful?
0 out of 0 found this helpful
Privacy policy    EULA    Terms of service   
Copyright © , Logpoint. All rights reserved.

Note: We use cookies that are essential for the smooth functioning of our website.