Lucene search

Japan Vulnerability NotesJVN:19241292

HistoryJan 11, 2017 - 12:00 a.m.

JVN#19241292: Cybozu Remote Service Manager fails to verify client certificates

2017-01-1100:00:00

Japan Vulnerability Notes

jvn.jp

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

CVSS3

4.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

45.3%

JSON

Remote Service Manager provided by Cybozu, Inc. is a software to access internal systems such as Cybozu products via “Cybozu Remote Service”. Remote Service Manager fails to verify client certificates.

Impact

A user may access internal web systems that do not allow access from external network. As a result, unintended operations may be conducted on those systems.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

Remote Service Manager 3.0.0 to 3.1.4

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

CVSS3

4.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

45.3%

JSON

Related for JVN:19241292