Lucene search

Japan Vulnerability NotesJVN:15185184

HistoryJun 30, 2021 - 12:00 a.m.

JVN#15185184: IkaIka RSS Reader vulnerable to cross-site scripting

2021-06-3000:00:00

Japan Vulnerability Notes

jvn.jp

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

44.9%

JSON

IkaIka RSS Reader contains a cross-site scripting vulnerability (CWE-79), due to the improper processing of RSS registration.

Impact

If a malicious RSS feed is loaded into the product, an arbitrary script may be executed on the web browser where the product is running.

Solution

Do not use IkaIka RSS Reader
Please stop use of IkaIka RSS Reader.
The developer has stopped distributing the product.

Products Affected

IkaIka RSS Reader all versions

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

44.9%

JSON

Related for JVN:15185184