LogStare Collector にクロスサイトリクエストフォージェリ (Cross-site request forgery) の脆弱性が存在します。ログイン中のユーザーが細工されたページを閲覧すると、意図しない操作が実行される可能性があります。

A successful CSRF attack against LogStare Collector could allow an attacker to perform actions as the logged-in user. This could include modifying configurations, accessing sensitive data, or potentially even escalating privileges depending on the user's role and permissions within the LogStare Collector environment. The attacker would need to trick the user into visiting a malicious webpage, which could be achieved through phishing emails, compromised websites, or other social engineering techniques. The blast radius of this vulnerability is limited to the scope of actions the affected user can perform within LogStare Collector.

Organizations using LogStare Collector in environments where users routinely access sensitive data or perform administrative tasks are at increased risk. Shared hosting environments where multiple users share the same LogStare Collector instance are particularly vulnerable, as an attacker could potentially compromise the accounts of all users on the shared host.

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -eq "LogStareCollector"}

• windows / supply-chain:

Get-ItemProperty -Path 'HKLM:\Software\LogStare\Collector' -Name Version

• generic web: Check HTTP headers for unusual Referer values or unexpected URL parameters. • generic web: Inspect LogStare Collector's configuration files for any unusual or suspicious entries.

1. 2025-11-21Disclosure

   disclosure

1. 予約済み2025-11-10
2. 公開日2025-11-21
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-62687 is to upgrade LogStare Collector to version 2.4.2 or later, which contains the fix. If immediate upgrading is not possible, consider implementing stricter input validation and output encoding within the application to prevent the injection of malicious URLs. Additionally, implement a Content Security Policy (CSP) to restrict the sources from which the browser can load resources, reducing the attack surface. After upgrading, confirm the fix by attempting to trigger a known CSRF attack vector and verifying that the action is blocked.