High severity · published Dec 17, 2019
CVE-2019-3992
ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker may gain access to valid admin usernames and, in older versions of ELOG, passwords.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Elog · Elog Project
through 3.1.4-57bea22 · source: NVD
FE
Fedora · Fedoraproject
30; 31 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3992
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3992
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IN3FP6VXYSD4OMUCFZNOL7MKPWRQFAL/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4IAS4HI24H2ERKBZTDEVJ3LEQEFWYSCT/
Exploit
https://www.tenable.com/security/research/tra-2019-53
More from Elog
8.8
CVE-2025-64349
ELOG user profile missing authorization
8.0
CVE-2025-62618
ELOG file upload stored XSS
7.5
CVE-2019-3995
ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference
7.5
CVE-2019-3994
ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free
7.5
CVE-2019-3993
ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability