GUP (generic update process) in LightySoft LogMX before 7.4.0 does...

Vulnerability Description

GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update. The update process relies on cleartext HTTP. The attacker could replace the LogMXUpdater.class file.

References

• https://logmx.com/download
• https://bmantra.github.io/logmx/logmx.html
• https://github.com/bmantra/bmantra.github.io/blob/master/logmx/logmx.html