Lucene search

Japan Vulnerability NotesJVN:41129639

HistoryFeb 01, 2024 - 12:00 a.m.

JVN#41129639: Payment EX vulnerable to information disclosure

2024-02-0100:00:00

Japan Vulnerability Notes

jvn.jp

payment ex

information disclosure

software update

vulnerability

simplesite

cwe-200

merchandise

remote attacker

unauthenticated

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

41.7%

JSON

Payment EX provided by Simplesite contains an information disclosure vulnerability (CWE-200).

Impact

A remote unauthenticated attacker may obtain the information of the user who purchases merchandise using Payment EX.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.

Products Affected

Payment EX Ver1.1.5b and earlier

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

41.7%

JSON

Related for JVN:41129639