JVNDB-2015-000104

Research Artisan Lite vulnerable to cross-site scripting

Research Artisan Lite provided by Research Artisan Project is an access analysis tool. Research Artisan Lite contains multiple cross-site scripting vulnerabilities (CWE-79).

Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Research Artisan Project

• Research Artisan Lite prior to ver.1.18

There are two attack scenarios.

1. If a user views a malicious web page, an arbitrary script may be executed on the user's web browser.
2. An attacker accesses a specially crafted URL which may include javascript code. The server then stores the access logs for analysis. When an administrator views the analysis results, a script is executed on the administrator's web browser.

[Update the Software]
Update to the latest version according to the information provided by the developer.

Research Artisan Project

• Research Artisan Project : Research Artisan Project website (in Japanese)

1. Cross-site Scripting(CWE-79) [IPA Evaluation]

1. CVE-2015-2976

1. JVN : JVN#58020495
2. National Vulnerability Database (NVD) : CVE-2015-2976

• [2015/07/24]
    Web page was published
  [2015/07/28]
    References : Content was added