CVE-2024-7600: Directory Traversal in Logsign Unified SecOps Platform

The impact of CVE-2024-7600 is significant due to the ability to delete arbitrary files as the root user. A successful exploit could allow an attacker to completely compromise the Logsign Unified SecOps Platform instance, potentially leading to data exfiltration, system disruption, or even complete system takeover. The ability to delete critical configuration files could render the platform unusable, impacting security monitoring and incident response capabilities. The requirement for authentication limits the immediate attack surface, but if an attacker gains valid credentials, the potential for damage is substantial.

1. Reserved2024-08-08
2. Published2024-08-21
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-7600 is to upgrade Logsign Unified SecOps Platform to version 6.4.23 or later. If an immediate upgrade is not possible, consider implementing stricter access controls to limit the number of users with administrative privileges. Review and audit user accounts to identify and disable any unnecessary or suspicious accounts. Implement a Web Application Firewall (WAF) with rules to block attempts to manipulate file paths. Monitor system logs for suspicious file deletion activity. After upgrading, confirm the fix by attempting to access a restricted file via the HTTP API and verifying that access is denied.