[Japanese]
|
JVNDB-2018-000113
|
Multiple vulnerabilities in OpenDolphin
|
OpenDolphin provided by Life Sciences Computing Corporation contains multiple vulnerabilities listed below.
* Privilege escalation - CVE-2018-16161
* Information disclosure (CWE-200) - CVE-2018-16162
* Restrict access permissions failure (CWE-284) - CVE-2018-16163
Symantec Japan, Inc. Advisory Services Team reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
CVSS V3 Severity: Base Metrics 8.8 (High) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
CVSS V2 Severity: Base Metrics 6.5 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Low
- Authentication: Single Instance
- Confidentiality Impact: Partial
- Integrity Impact: Partial
- Availability Impact: Partial
The above CVSS base scores have been assigned for CVE-2018-16161
|
CVSS V3 Severity:
Base Metrics:
4.3 (Medium) [IPA Score]
-
Attack Vector: Network
-
Attack Complexity: Low
-
Privileges Required: Low
-
User Interaction: None
-
Scope: Unchanged
-
Confidentiality Impact: Low
-
Integrity Impact: None
-
Availability Impact: None
CVSS V2 Severity:Base Metrics:
4.0 (Low)
[IPA Score]
-
Access Vector: Network
-
Access Complexity: Low
-
Authentication: Single
-
Confidentiality Impact: Partial
-
Integrity Impact: None
-
Availability Impact: None
The above CVSS base scores have been assigned for CVE-2018-16162
|
CVSS V3 Severity:
Base Metrics:
4.3 (Medium) [IPA Score]
-
Attack Vector: Network
-
Attack Complexity: Low
-
Privileges Required: Low
-
User Interaction: None
-
Scope: Unchanged
-
Confidentiality Impact: None
-
Integrity Impact: Low
-
Availability Impact: None
CVSS V2 Severity:Base Metrics:
4.0 (Low)
[IPA Score]
-
Access Vector: Network
-
Access Complexity: Low
-
Authentication: Single
-
Confidentiality Impact: None
-
Integrity Impact: Partial
-
Availability Impact: None
The above CVSS base scores have been assigned for CVE-2018-16163
|
|
Life Sciences Computing Corporation
- OpenDolphin 2.7.0 and earlier
|
|
* A user may perform unintended operations with the administrative privilege - CVE-2018-16161
* A user may obtain other users' sensitive information such as ID and password - CVE-2018-16162
* A user may create or delete other users - CVE-2018-16163
|
[Update the Software]
Update to the latest version according to the information provided by the developer.
|
Life Sciences Computing Corporation
|
- Information Exposure(CWE-200) [IPA Evaluation]
- Permissions(CWE-264) [IPA Evaluation]
|
- CVE-2018-16161
- CVE-2018-16162
- CVE-2018-16163
|
- JVN : JVN#59394343
- National Vulnerability Database (NVD) : CVE-2018-16161
- National Vulnerability Database (NVD) : CVE-2018-16162
- National Vulnerability Database (NVD) : CVE-2018-16163
|
- [2018/10/26]
Web page was published
- [2019/07/26]
References : Contents were added
|