[Japanese]

JVNDB-2014-000064

Web Kyukincho vulnerable to cross-site request forgery

Overview

Web Kyukincho provided by Intercom, Inc. is a software that digitizes and distributes a pay statement and others. Web Kyukincho contains a cross-site request forgery vulnerability.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 4.0 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


Intercom, Inc.
  • Web Kyukincho V3 versions prior to 3.0.030

According to the developer, Web Kyukincho Cloud is not affected by this vulnerability.
Impact

If a user views a malicious page while logged in, unintended operations may be conducted.
Solution

[Update the Software]
Update to the latest version according to the information provided by the developer.

According to the developer, Web Kyukincho Cloud is not affected by this vulnerability.
Vendor Information

Intercom, Inc.
CWE (What is CWE?)

  1. Cross-Site Request Forgery(CWE-352) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2014-3881
References

  1. JVN : JVN#36259412
  2. National Vulnerability Database (NVD) : CVE-2014-3881
Revision History

  • [2014/06/25]
      Web page was published
    [2014/07/01]
      References : Content was added

Date Public2014/06/25
Date First Published2014/06/25
Date Last Updated2014/07/01