[Japanese]

JVNDB-2005-000789

Hyper NIKKI System cross-site request forgery vulnerability

Overview

Hyper NIKKI System (hns), a weblog system from the Hyper NIKKI System Project, contains a cross-site request forgery (CSRF) vulnerability.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 2.6 (Low) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


HyperNikkiSystem Project
  • hns 2.10-pl3
  • hns 2.19.5 (hns-lite-2.19.5)

Impact

If a weblog administrator accesses a malicious web page, an attacker could add, alter, or delete the weblog text.
If the weblog text is successfully altered, the attacker could perform a cross-site scripting attack to steal cookie information of weblog readers (including weblog administrator) issued by Hyper NIKKI System.
An attacker could impersonate a user by stealing the cookie information.
Solution

Vendor Information

HyperNikkiSystem Project
CWE (What is CWE?)

CVE (What is CVE?)

References

  1. JVN : JVN#97422426
Revision History

  • [2008/05/21]
      Web page published

Date Public2005/09/01
Date First Published2008/05/21
Date Last Updated2008/05/21