CVE-2020-35488

Published: Jan 5, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.)

Affected (1)

Products: Nxlog: Nxlog

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nxlog Nxlog	Before 3.0.2272

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

https://github.com/GuillaumePetit84/CVE-2020-35488

Source: cve@mitre.org

ExploitMitigationThird Party Advisory

https://gitlab.com/nxlog-public/nxlog-ce/-/blob/master/ChangeLog.txt#L2

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/GuillaumePetit84/CVE-2020-35488

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMitigationThird Party Advisory

https://gitlab.com/nxlog-public/nxlog-ce/-/blob/master/ChangeLog.txt#L2

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

Timeline

No history available yet.