Lucene search

Japan Vulnerability NotesJVN:83917769

HistoryJan 16, 2017 - 12:00 a.m.

JVN#83917769: AttacheCase vulnerable to directory traversal

2017-01-1600:00:00

Japan Vulnerability Notes

jvn.jp

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.003

Percentile

69.6%

JSON

AttacheCase is an open source file encryption software provided by HiBARA Software. AttacheCase contains a directory traversal vulnerability (CWE-22) due to a flaw in processing filenames in ATC files.

Impact

Decrypting a crafted ATC file may result in creation of an arbitrary file or overwriting of an existing file.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

AttacheCase ver.2.8.2.8 and earlier
AttacheCase ver.3.2.0.4 and earlier

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.003

Percentile

69.6%

JSON

Related for JVN:83917769