|
[Japanese]
|
JVNDB-2009-000033
|
REP-BBS from MT312 vulnerable to cross-site scripting
|
|
REP-BBS from MT312 contains a cross-site scripting vulnerability.
REP-BBS from MT312, is a web log system that supports posting and viewing web logs from a mobile phone. REP-BBS contains a cross-site scripting vulnerability.
Note that versions of REP-BBS (repbbs.lzh) that contain "model.php" and "config.php" with a timestamp prior to May 21, 2009 are vulnerable.
Masako Oono reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V2 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
MT312
|
|
|
An arbitrary script may be executed on the user's web browser.
|
|
[Update the software]
Update the software to the latest version at MT312 (repbbs.lzh)
|
|
MT312
|
|
- Cross-site Scripting(CWE-79) [IPA Evaluation]
|
|
- CVE-2009-1880
|
|
- JVN : JVN#01115659
- National Vulnerability Database (NVD) : CVE-2009-1880
- Secunia Advisory : SA35251
- JVN iPedia (Japanese) : JVNDB-2009-000033
|
|
- [2009/05/29]
Web page published
|
