Lucene search

JpcertCVE-2015-5643

HistoryOct 06, 2015 - 1:59 a.m.

CVE-2015-5643

2015-10-0601:59:23

CWE-94

jpcert

web.nvd.nist.gov

cve-2015-5643

icz matcha invoice

security vulnerability

remote code execution

database misconfiguration

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.006

Percentile

79.0%

JSON

The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.

Affected configurations

Nvd

Node

iczmatchasnsRange≤1.3.6

VendorProductVersionCPE
iczmatchasns*cpe:2.3:a:icz:matchasns:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
icz	matchasns	*	cpe:2.3:a:icz:matchasns::::::::

References

jvn.jp/en/jp/JVN66984217/index.html

jvndb.jvn.jp/jvndb/JVNDB-2015-000144

oss.icz.co.jp/news/?p=1073

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.006

Percentile

79.0%

JSON

Related for CVE-2015-5643