CVE-2020-35488
CVSS v3
7.5
HIGH
EPSS Score
19.4 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.)
Technical details
- Published
- 2021-01-05
- Exploit-DB
- EDB-49283
Frequently asked questions
What is CVE-2020-35488?
The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.)
Is CVE-2020-35488 actively exploited?
Active exploitation of CVE-2020-35488 has not been confirmed. The EPSS score is 19.4%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2020-35488?
CVE-2020-35488 has a CVSS v3 base score of 7.5 (HIGH severity).
Is CVE-2020-35488 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2020 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).