JVNDB-2008-000055

Blogn vulnerable to cross-site scripting

Blogn from R-ONE Computer contains a cross-site scripting vulnerability.

Blogn from R-ONE Computer is software for creating blogs. Blogn contains a cross-site scripting vulnerability.

Masako Ohno of NetAgent Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendor under Information Technology Early Warning Partnership.

Base Metrics: 2.6 (Low) [IPA Score]

• Access Vector: Network
• Access Complexity: High
• Authentication: None
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

BlognPlus

• Blogn(burogun) v1.9.7 and earlier

An arbitrary script may be executed on the user's web browser.

[Update the Software]
Apply the latest update provided by the vendor.

BlognPlus

• Blogn : 2008/08/29 (Japanese)

1. Cross-site Scripting(CWE-79) [IPA Evaluation]

1. CVE-2008-3884

1. JVN : JVN#03859837
2. National Vulnerability Database (NVD) : CVE-2008-3884
3. Secunia Advisory : SA31662
4. JVN iPedia (Japanese) : JVNDB-2008-000055

[2008/09/02]
  Web page published