Lucene search

[email protected]CVE-2017-2143

HistoryApr 28, 2017 - 4:59 p.m.

CVE-2017-2143

2017-04-2816:59:01

CWE-425

[email protected]

web.nvd.nist.gov

cs-cart

japanese edition

access restriction bypass

remote attackers

vulnerability

cve-2017-2143

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.2%

JSON

CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php.

Affected configurations

Vulners

NVD

Node

frogman_office_inc.cs-cart_japanese_editionMatch4.3.10-jp-1

frogman_office_inc.cs-cart_multivendor_japanese_editionMatch4.3.10-jp-1

CPENameOperatorVersion
frogman_office_inc:cs-cart_japanese_editionfrogman office inc cs-cart japanese editioneq4.3.10-jp-1
frogman_office_inc:cs-cart_multivendor_japanese_editionfrogman office inc cs-cart multivendor japanese editioneq4.3.10-jp-1

CPE	Name	Operator	Version
frogman_office_inc:cs-cart_japanese_edition	frogman office inc cs-cart japanese edition	eq	4.3.10-jp-1
frogman_office_inc:cs-cart_multivendor_japanese_edition	frogman office inc cs-cart multivendor japanese edition	eq	4.3.10-jp-1

CNA Affected

[
  {
    "product": "CS-Cart Japanese Edition",
    "vendor": "Frogman Office Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "v4.3.10-jp-1 and earlier"
      }
    ]
  },
  {
    "product": "CS-Cart Multivendor Japanese Edition",
    "vendor": "Frogman Office Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "v4.3.10-jp-1 and earlier"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN25598952/index.html

tips.cs-cart.jp/fix-jvn-25598952.html

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.2%

JSON

Related for CVE-2017-2143

nvd1 cvelist1 jvn1 prion1