Lucene search

JpcertCVE-2015-5644

HistoryOct 06, 2015 - 1:59 a.m.

CVE-2015-5644

2015-10-0601:59:24

CWE-94

jpcert

web.nvd.nist.gov

icz matcha sns

installer

vulnerability

remote attackers

arbitrary php code

cve-2015-5644

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.006

Percentile

79.0%

JSON

The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.

Affected configurations

Nvd

Node

iczmatchasnsRange≤1.3.6

VendorProductVersionCPE
iczmatchasns*cpe:2.3:a:icz:matchasns:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
icz	matchasns	*	cpe:2.3:a:icz:matchasns::::::::

References

jvn.jp/en/jp/JVN08535069/index.html

jvndb.jvn.jp/jvndb/JVNDB-2015-000145

oss.icz.co.jp/news/?p=1075

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.006

Percentile

79.0%

JSON

Related for CVE-2015-5644