JVN#83334799: Multiple vulnerabilities in Special Interest Group Network for Analysis and Liaison's API

Special Interest Group Network for Analysis and Liaison’s “Inter-SOC Cooperation API” provided by Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) contains multiple vulnerabilities listed below.

Improper Authorization in Information Provision function (CWE-285) - CVE-2023-38751

Improper Authorization in Information Provision and Group Message functions (CWE-285) - CVE-2023-38752

Impact

• Organization information of the information receiver that is set as “non-disclosure” in the information provision operation may be viewed by an authorized API user - CVE-2023-38751
• Attribute information of the poster that is set as"non-disclosure" in the system settings may be viewed by an authorized API user - CVE-2023-38752

Solution

Apply the Patch
Apply the patch according to the information provided by the developer.
For more information, contact the developer.

Apply the workaround
If the patch cannot be applied, applying the following workaround may mitigate the impacts of these vulnerabilities.

• Configure to stop using the API

Products Affected

• Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7