CVE-2017-20020

Published: Jun 9, 2022Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A vulnerability, which was classified as problematic, has been found in Solare Solar-Log 2.8.4-56/3.5.2-85. Affected by this issue is some unknown functionality. The manipulation leads to cross site request forgery. The attack may be launched remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.

Affected (16)

Products: Solar Log: Solar Log 250 Firmware, Solar Log 300 Firmware, Solar Log 500 Firmware, Solar Log 800e Firmware, Solar Log 1000 Firmware, Solar Log 1000 Pm+ Firmware, Solar Log 1200 Firmware, Solar Log 2000 Firmware

Solar Log

8 products

Solar Log 250 Firmware

Solar Log 300 Firmware

Solar Log 500 Firmware

Solar Log 800e Firmware

Solar Log 1000 Firmware

Solar Log 1000 Pm+ Firmware

Solar Log 1200 Firmware

Solar Log 2000 Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 250 Firmware	Version 2.8.4-56
Solar Log Solar Log 250 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 250	All versions

Configuration B

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 300 Firmware	Version 2.8.4-56
Solar Log Solar Log 300 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 300	All versions

Configuration C

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 500 Firmware	Version 2.8.4-56
Solar Log Solar Log 500 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 500	All versions

Configuration D

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 800e Firmware	Version 2.8.4-56
Solar Log Solar Log 800e Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 800e	All versions

Configuration E

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 1000 Firmware	Version 2.8.4-56
Solar Log Solar Log 1000 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 1000	All versions

Configuration F

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 1000 Pm+ Firmware	Version 2.8.4-56
Solar Log Solar Log 1000 Pm+ Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 1000 Pm+	All versions

Configuration G

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 1200 Firmware	Version 2.8.4-56
Solar Log Solar Log 1200 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 1200	All versions

Configuration H

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 2000 Firmware	Version 2.8.4-56
Solar Log Solar Log 2000 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 2000	All versions

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

http://seclists.org/fulldisclosure/2017/Mar/58

Source: cna@vuldb.com

ExploitMailing ListThird Party Advisory

https://vuldb.com/?id.98930

Source: cna@vuldb.com

Third Party Advisory

http://seclists.org/fulldisclosure/2017/Mar/58

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://vuldb.com/?id.98930

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.