Lucene search

Japan Vulnerability NotesJVN:60140221

HistoryAug 31, 2023 - 12:00 a.m.

JVN#60140221: Multiple vulnerabilities in i-PRO VI Web Client

2023-08-3100:00:00

Japan Vulnerability Notes

jvn.jp

i-pro vi web client

open redirect

reflected cross-site scripting

stored cross-site scripting

cve numbers

phishing attack

arbitrary script execution

update software

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

27.0%

JSON

VI Web Client provided by i-PRO Co., Ltd. is Video Insight’s video management software. VI Web Client contains multiple vulnerabilities listed below.

Open Redirect (CWE-601) - CVE-2023-38574

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N	Base Score: 4.7
CVSS v2	AV:N/AC:M/Au:N/C:N/I:P/A:N	Base Score: 4.3

Reflected Cross-site Scripting (CWE-79) - CVE-2023-39938

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	Base Score: 6.1
CVSS v2	AV:N/AC:M/Au:N/C:N/I:P/A:N	Base Score: 4.3

Stored Cross-site Scripting in View setting page (CWE-79) - CVE-2023-40535

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Base Score: 5.4
CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

Stored Cross-site Scripting in Map setting page (CWE-79) - CVE-2023-40705

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Base Score: 5.4
CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

Impact

When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack - CVE-2023-38574
An arbitrary script may be executed on a logged-in user’s web browser - CVE-2023-39938
When accessing a specially crafted page added by a remote authenticated attacker, an arbitrary script may be executed on a logged-in user’s web browser - CVE-2023-40535, CVE-2023-40705

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.
These vulnerabilities have been addressed in VI Web Client 7.9.6.

Products Affected

VI Web Client prior to 7.9.6

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

27.0%

JSON

Related for JVN:60140221