JVNDB-2019-000050

[Japanese]
JVNDB-2019-000050
Central Dogma vulnerable to cross-site scripting
Overview
Central Dogma provided by LINE Corporation contains a cross-site scripting vulnerability (CWE-79). LINE Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LINE Corporation coordinated under the Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)
CVSS V3 Severity: Base Metrics 6.1 (Medium) [IPA Score] Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality Impact: Low Integrity Impact: Low Availability Impact: None CVSS V2 Severity: Base Metrics 4.3 (Medium) [IPA Score] Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
Affected Products

LINE Corporation Central Dogma 0.17.0 to 0.40.1

Impact
An arbitrary script may be executed on the user's web browser.
Solution
[Update the Software] Update to the latest version according to the information provided by the developer.
Vendor Information
LINE Corporation GitHub : GitHub - line/centraldogma: Highly-available version-controlled service configuration repository based on Git, ZooKeeper and HTTP/2 GitHub : Fix XSS on a search feature by ikhoon - Pull Request #422 - line/centraldogma - GitHub LINE : Welcome to Central Dogma - Central Dogma 0.40.1 documentation
CWE (What is CWE?)
Cross-site Scripting(CWE-79) [IPA Evaluation]
CVE (What is CVE?)
CVE-2019-6002
References
JVN : JVN#94889214 National Vulnerability Database (NVD) : CVE-2019-6002
Revision History
[2019/07/31] Web page was published [2019/10/04] References : Content was added


Date Public	2019/07/31
Date First Published	2019/07/31
Date Last Updated	2019/10/04

Central Dogma vulnerable to cross-site scripting