Gpm Light
Monthly
Unauthenticated remote access to system logs in ezGlobal's GPM LIGHT lets anyone who can reach the product's log-serving endpoint read sensitive operational data without credentials, user interaction, or special configuration (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, 6.9; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is confined to confidentiality (C:L) - the attacker reads logs rather than altering or disrupting the service - so real-world severity hinges on whether those logs contain credentials, session tokens, internal hostnames, or PII instead of benign operational messages. Affected versions are unspecified (wildcard CPE), meaning every deployment should be treated as potentially vulnerable, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.
Unauthenticated remote access to system logs in ezGlobal's GPM LIGHT lets anyone who can reach the product's log-serving endpoint read sensitive operational data without credentials, user interaction, or special configuration (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, 6.9; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is confined to confidentiality (C:L) - the attacker reads logs rather than altering or disrupting the service - so real-world severity hinges on whether those logs contain credentials, session tokens, internal hostnames, or PII instead of benign operational messages. Affected versions are unspecified (wildcard CPE), meaning every deployment should be treated as potentially vulnerable, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.