JVNDB-2016-000072

[Japanese]
JVNDB-2016-000072
WebARENA formmail vulnerable to cross-site scripting
Overview
formmail used for the WebARENA Service provided by NTT PC Communications Incorporated contains a cross-site scripting vulnerability (CWE-79). OHTA, Yoshinori of Business Architects Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)
CVSS V3 Severity: Base Metrics 6.1 (Medium) [IPA Score] Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality Impact: Low Integrity Impact: Low Availability Impact: None CVSS V2 Severity: Base Metrics 4.3 (Medium) [IPA Score] Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
Affected Products

NTT PC Communications Incorporated FormMail Version 2.2 and earlier

Impact
An arbitrary script may be executed on the user's web browser.
Solution
[Update the software] Update to the latest version according to the information provided by the developer.
Vendor Information
NTT PC Communications Incorporated NTTPC Communications : About the Vulnerability of the Suite CGI formmail functionality (in Japanese) NTTPC Communications : About the Vulnerability of the Suite2 formmail functionality (in Japanese) NTTPC Communications : [CGI/SSI] formmail (in Japanese)
CWE (What is CWE?)
Cross-site Scripting(CWE-79) [IPA Evaluation]
CVE (What is CVE?)
CVE-2016-1230
References
JVN : JVN#24143619 National Vulnerability Database (NVD) : CVE-2016-1230
Revision History
[2016/05/27] Web page was published [2016/06/08] References : Content was added


Date Public	2016/05/27
Date First Published	2016/05/27
Date Last Updated	2016/06/08

WebARENA formmail vulnerable to cross-site scripting