Free Trial

ArcSight Logger Security Vulnerability

Overview :
‘External Task is undefined’ & ‘Syntax error’ errors appear on browser console after a Logger report query object is being created (new/modify) using IE browser.

Reports with lengthy names (> 60 characters) emailed via SMTP server are attached with an incorrect filename and extension.
Affected Product(s) :
  • ArcSight Logger 6.71
Vulnerability Details :
CVE ID : CVE-2019-11655 (unrestricted file upload)
Affected versions: Logger 6.7.0 and later​
Severity: Critical ​
CVSS 3.0 Rating: 9.9 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) ​
CWE Reference: 434 – Unrestricted Upload of File with Dangerous Typ​e
CVE ID : CVE-2019-11656 (stored XSS​)
Affected versions: versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0​
Severity: Medium ​
CVSS 3.0 Rating: 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) ​
CWE Reference: 79 – Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)​

Remediation / Fixes :

Micro Focus recommends to apply this HotFix. HotFix 6.7.1.8262.0 on ArcSight Logger 6.7.1, either in software or appliance form factor. These fixes will also be part of the upcoming release of Logger.

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2022-1840 : Home Clean Services Management System Stored Cross-Site Scripting (XSS)

CVE-2022-1840 : Home Clean Services Management System Stored Cross-Site Scripting (XSS)

Description Persistent XSS (or Stored XSS) attack is one of the three major categories of XSS attacks, the others being

Learn more
CVE-2022-1558 : Multiple Stored Cross-Site Scripting vulnerabilities in WordPress curtain plugin 1.0.2

CVE-2022-1558 : Multiple Stored Cross-Site Scripting vulnerabilities in WordPress curtain plugin 1.0.2

Description Several Cross-Site Scripting vulnerabilities in the Curtain WordPress plugin. Due to these Cross-Site Scripting vulnerabilities, an attacker would be

Learn more
CVE-2022-AVAST2 : Self-Defense Bypass via Repairing Function

CVE-2022-AVAST2 : Self-Defense Bypass via Repairing Function

Description It was noted that there is security checking to prevent some of the Avast processes from loading of undesired/unsigned

Learn more