CVE-2024-33858

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-33858
An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_name parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://servicedesk.logpoint.com/hc/en-us/articles/18533668045725-Path-Injection-on-Enrichment-Sources-leading-to-arbitrary-file-write-in-tmp-folder Vendor Advisory
https://www.logpoint.com/ Product
https://servicedesk.logpoint.com/hc/en-us/articles/18533668045725-Path-Injection-on-Enrichment-Sources-leading-to-arbitrary-file-write-in-tmp-folder Vendor Advisory
https://www.logpoint.com/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:logpoint:siem:*:*:*:*:*:*:*:*
History

18 Apr 2025, 12:38

Type Values Removed Values Added
CPE cpe:2.3:a:logpoint:siem:*:*:*:*:*:*:*:*
First Time Logpoint
Logpoint siem
References () https://servicedesk.logpoint.com/hc/en-us/articles/18533668045725-Path-Injection-on-Enrichment-Sources-leading-to-arbitrary-file-write-in-tmp-folder - () https://servicedesk.logpoint.com/hc/en-us/articles/18533668045725-Path-Injection-on-Enrichment-Sources-leading-to-arbitrary-file-write-in-tmp-folder - Vendor Advisory
References () https://www.logpoint.com/ - () https://www.logpoint.com/ - Product

21 Nov 2024, 20:15

Type Values Removed Values Added
References () https://servicedesk.logpoint.com/hc/en-us/articles/18533668045725-Path-Injection-on-Enrichment-Sources-leading-to-arbitrary-file-write-in-tmp-folder - () https://servicedesk.logpoint.com/hc/en-us/articles/18533668045725-Path-Injection-on-Enrichment-Sources-leading-to-arbitrary-file-write-in-tmp-folder -
References () https://www.logpoint.com/ - () https://www.logpoint.com/ -
Summary
  • (es) Se descubrió un problema en Logpoint antes de 7.4.0. Se observa una vulnerabilidad de inyección de ruta al agregar una fuente de enriquecimiento CSV. El parámetro source_name podría cambiarse a una ruta absoluta; esto escribirá el archivo CSV en esa ruta dentro del directorio /tmp.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-91

07 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-07 16:15

Updated : 2025-04-18 12:38

NVD link : CVE-2024-33858

Mitre link : CVE-2024-33858

CVE.ORG link : CVE-2024-33858

JSON object : View

Products Affected

logpoint

  • siem
CWE
CWE-91

XML Injection (aka Blind XPath Injection)