Lucene search

Japan Vulnerability NotesJVN:94169589

HistoryDec 15, 2020 - 12:00 a.m.

JVN#94169589: Multiple vulnerabilities in GROWI

2020-12-1500:00:00

Japan Vulnerability Notes

jvn.jp

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.006 Low

EPSS

Percentile

77.8%

JSON

GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below.

Denial-of-service (DoS) due to improper verification of input values (CWE-400) - CVE-2020-5682

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	Base Score: 5.3
CVSS v2	AV:N/AC:L/Au:N/C:N/I:N/A:P	Base Score: 5.0

Directory traversal due to improper verification of uploaded files (CWE-22) - CVE-2020-5683

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	Base Score: 4.3
CVSS v2	AV:N/AC:M/Au:N/C:N/I:P/A:N	Base Score: 4.3

Impact

A remote attacker may be able to cause a denial-of-service (DoS) condition. - CVE-2020-5682
When a specially crafted file is uploaded, data in the product may be altered. - CVE-2020-5683

Solution

Update the Software
Update to the appropriate version according to the information provided by the developer.

The developer recommends users to upgrade the product to v4.2 series because v3 series and earlier are End-of-Support and no patches available.

Products Affected

GROWI versions prior to v4.2.3 (v4.2 Series)
GROWI versions prior to v4.1.12 (v4.1 Series)
GROWI v3 series and earlier

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.006 Low

EPSS

Percentile

77.8%

JSON

Related for JVN:94169589