[Japanese]

JVNDB-2019-000021

API server used by JR East Japan train operation information push notification App for Android fails to restrict access permissions

Overview

JR East Japan train operation information push notification App for Android provided by East Japan Railway Company fails to restrict access permissions (CWE-284).
The application is no longer available/supported, and its service was ended in 2019 march 23.

Tomoya Takahashi of TCU Communication engineering Club reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 6.5 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 6.4 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


East Japan Railway Company
  • trainserviceinfo App for Android version 1.2.4 and earlier

Impact

A remote attacker may obtain or alter registration information of a user.
Solution

[Do not use JR East Japan train operation information push notification App for Android]
The application is no longer available/supported, and its service was ended in 2019 march 23. It is recommended to stop using and uninstall it.
The developer recommends that users should use JR East Japan App and/or JR East Japan Chat Bot for LINE, or check the information available through the developer's website.
Vendor Information

East Japan Railway Company
CWE (What is CWE?)

  1. Permissions(CWE-264) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2019-5954
References

  1. JVN : JVN#01119243
  2. National Vulnerability Database (NVD) : CVE-2019-5954
Revision History

  • [2019/04/01]
      Web page was published
  • [2019/09/27]
      References : Contents were added

Date Public2019/04/01
Date First Published2019/04/01
Date Last Updated2019/04/01