CVE-2019-3994

Name of the Vulnerable Software and Affected Versions ELOG versions 3.1.4-57bea22 and below

Description The issue is related to a denial of service due to a use after free, where a remote unauthenticated attacker can crash the server by sending multiple HTTP POST requests. This causes the retrieve url() function to use a freed variable, leading to the denial of service.

Recommendations For ELOG versions 3.1.4-57bea22 and below, as a temporary workaround, consider restricting access to the retrieve url() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.