PatchTheCVECVE-2018-19513: In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY
CVE-2018-19513 is a high-severity flaw (CVSS 7.5) affecting webgalamb. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file could contain sensitive client data (email addresses) and also facilitates exploitation of SQL injection errors.
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 2.1% (top 18%) |
| CISA exploited list | No |
| Weakness | CWE-532 |
| Published | 2019-03-21 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-19513?
webgalamb: upgrade to newer than 7.0. Exact commands for each OS are on this page.
Is CVE-2018-19513 being exploited?
CVE-2018-19513 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-19513 affect?
CVE-2018-19513 affects webgalamb. Severity is high (CVSS 7.5). In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file could contain sensitive client data (email addresses) and also facilitates exploi
How urgent is CVE-2018-19513?
Priority 57/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2018-19515 CRITICAL 9.8 UPGRADE In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator
- CVE-2018-19514 CRITICAL 9.8 UPGRADE In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authen
- CVE-2018-19512 HIGH 7.2 UPGRADE In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to
- CVE-2018-19511 MEDIUM 6.5 DOWNGRADE wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1
- CVE-2018-19510 CRITICAL 9.8 UPGRADE subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header.