[Japanese]

JVNDB-2019-000021

API server used by JR East Japan train operation information push notification App for Android fails to restrict access permissions

Overview

JR East Japan train operation information push notification App for Android provided by East Japan Railway Company fails to restrict access permissions (CWE-284).
The application is no longer available/supported, and its service was ended in 2019 march 23.

Tomoya Takahashi of TCU Communication engineering Club reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 6.5 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 6.4 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


JR EAST
  • trainserviceinfo App for Android version 1.2.4 and earlier

Impact

A remote attacker may obtain or alter registration information of a user.
Solution

[Do not use JR East Japan train operation information push notification App for Android]
The application is no longer available/supported, and its service was ended in 2019 march 23. It is recommended to stop using and uninstall it.
The developer recommends that users should use JR East Japan App and/or JR East Japan Chat Bot for LINE, or check the information available through the developer's website.
Vendor Information

JR EAST
CWE (What is CWE?)

  1. Permissions(CWE-264) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2019-5954
References

  1. JVN : JVN#01119243
Revision History

  • [2019/04/01]
      Web page was published