Lucene search

Japan Vulnerability NotesJVN:91393903

HistoryFeb 01, 2018 - 12:00 a.m.

JVN#91393903: Multiple vulnerabilities in epg search result viewer(kkcald)

2018-02-0100:00:00

Japan Vulnerability Notes

jvn.jp

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.008 Low

EPSS

Percentile

81.9%

JSON

epg search result viewer(kkcald) provided by kkcal contains multiple vulnerabilities listed below.

Cross-site Scripting (CWE-79) - CVE-2018-0508

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	Base Score: 6.1
CVSS v2	AV:N/AC:M/AU:N/C:N/I:P/A:N	Base Score: 4.3

Cross-site request forgery (CWE-352) - CVE-2018-0509

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	Base Score: 4.3
CVSS v2	AV:N/AC:M/AU:N/C:N/I:P/A:N	Base Score: 4.3

Buffer overflow (CWE-121) - CVE-2018-0510

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L	Base Score: 6.3
CVSS v2	AV:N/AC:M/AU:N/C:P/I:P/A:P	Base Score: 6.8

Impact

An arbitrary script may be executed on the logged-in user’s web browser - CVE-2018-0508
If a user views a malicious page while logged in, unintended operations may be performed - CVE-2018-0509
A remote attacker may perform an unintended operation or execute a DoS (denial of service) attack - CVE-2018-0510

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

epg search result viewer(kkcald) 0.7.21 and earlier (CVE-2018-0508, CVE-2018-0509)
epg search result viewer(kkcald) 0.7.19 and earlier (CVE-2018-0510)

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.008 Low

EPSS

Percentile

81.9%

JSON

Related for JVN:91393903