Japan Vulnerability NotesJVN:87164507JVN#87164507: Calsos CSDJ fails to restrict access permissions
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
45.2%
Calsos CSDJ provided by NEC Platforms, Ltd. fails to restrict access permissions (CWE-264), which may lead to an unauthorized user being able to view the historical data without access privileges.
Impact
A user who can login to the product may obtain unauthorized historical data without access privileges.
Solution
Apply the appropriate firmware update
Apply the appropriate firimware update according to the information provided by the developer.
Apply a Workaround
The following workaround may mitigate the impacts of this vulnerability.
- Restrict the user permission to view all histrical data (i.e. “Login histry”, “Operation history”, “Control history”, and “Report history”)
For more information, please refer to the information provided by the developer (Japanese only).
Products Affected
- CSDJ-B 01.08.00 and earlier
- CSDJ-H 01.08.00 and earlier
- CSDJ-D 01.08.00 and earlier
- CSDJ-A 03.08.00 and earlier
Related
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
45.2%