ELOG CVE-2025-62618

Requires a valid authenticated ELOG account with the ability to create entries and upload file attachments (PR:L), and relies on a second victim user actively opening the attacker-supplied HTML attachment (UI:P) in a vulnerable ELOG version that renders uploaded HTML inline rather than as plain text. Exploitation is LIMITED by: (1) attacker must already have login credentials/posting rights; (2) no code runs until a victim opens the file, so a passive, un-opened attachment causes no harm; (3) the credential-theft payoff depends on ELOG transmitting usernames and password hashes in HTTP requests, which the script must capture; (4) instances upgraded to release 3.1.5-20251014 or later neutralize the issue by rendering HTML as plain text.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H) yields 8.6 (High), and the signals are internally consistent with a stored/persistent XSS (CWE-79): network reachable, low attack complexity, but requiring an already-authenticated low-privileged account (PR:L) and passive victim interaction (UI:P - a user must open the malicious attachment). No EPSS score was provided in the input, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation; no public exploit code was referenced either. Therefore this is a genuine, patchable integrity/confidentiality issue but not an emergency: exploitation is gated by (1) possession of a valid ELOG account and (2) a victim opening the attacker's HTML file. The standout aggravating factor is impact rather than exploitability - because ELOG transmits usernames and password hashes in certain HTTP requests, successful XSS harvests credentials that can be replayed or cracked offline, enabling privilege escalation and lateral movement. Net assessment: medium-to-high operational priority for organizations actually running ELOG, driven by credential exposure, but tempered by the authentication and user-interaction prerequisites and the absence of any exploitation-in-the-wild signal. Note the input provided only a CVSS 4.0 vector and no EPSS value - real-world exploitation probability could not be quantified from the data supplied.

A logged-in ELOG user with posting rights uploads a logbook attachment containing malicious HTML/JavaScript. When another user (e.g. an administrator) opens that entry, the script runs in their session and silently exfiltrates the username and password hash that ELOG includes in HTTP requests. The attacker then replays the credentials or cracks the hash offline to take over the higher-privileged account. No public exploit code was identified at time of analysis.