The processor_web plugin for ModLogAn 0.5.0 through 0.7.11, when used with the splitby option, allows local users to overwrite arbitrary files via a symlink attack on files specified as hostnames in a log file.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Modlogan | Modlogan | 0.5 (including) | 0.5 (including) |
| Modlogan | Modlogan | 0.5.6 (including) | 0.5.6 (including) |
| Modlogan | Modlogan | 0.5.7 (including) | 0.5.7 (including) |
| Modlogan | Modlogan | 0.6 (including) | 0.6 (including) |
| Modlogan | Modlogan | 0.7.11 (including) | 0.7.11 (including) |