JVN#83459967: Janetter vulnerable to cross-site request forgery

Janetter is a client software for using Twitter. Janetter contains a cross-site request forgery vulnerability.

Impact

When a malicious page is opened with a web browser while Janetter is being used, the user may be impersonated to post tweets, upload local image files, and OS commands may be executed with the privileges of Janetter.

Solution

Update the software
Update to the latest version according to the information provided by the developer.

According to the developer, the Windows version of Janetter contains an automatic update feature. This feature automatically updates Janetter once a day.

Products Affected

• Janetter for Windows versions prior to 3.3.0.0
• Janetter for Macintosh versions prior to 3.3.0