[Japanese]

JVNDB-2020-000052

SKYSEA Client View vulnerable to privilege escalation

Overview

SKYSEA Client View provided by Sky Co., LTD. is an Enterprise IT Asset Management Tool. SKYSEA Client View contains a privilege escalation vulnerability (CWE-268).

Sky Co., LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC coordinated under the Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.8 (High) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
  • Access Vector: Local
  • Access Complexity: Low
  • Authentication: Single Instance
  • Confidentiality Impact: Complete
  • Integrity Impact: Complete
  • Availability Impact: Complete
Affected Products


Sky Co., LTD.
  • SKYSEA Client View Ver.12.200.12n to 15.210.05f

Impact

A user who can login to the PC where the product is installed may obtain unauthorized privileges and modify/obtain sensitive information or perform unintended operations.
Solution

[Apply the Patch]
Apply the patch according to the information provided by the developer.
Vendor Information

Sky Co., LTD.
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2020-5617
References

  1. JVN : JVN#25422698
  2. JPCERT : JPCERT-AT-2020-0031
Revision History

  • [2020/08/03]
      Web page was published
  • [2020/08/04] 
     Affected Products : Content was modified
     Vendor Information : Content was modified
     References : Content was added

Date Public2020/08/03
Date First Published2020/08/03
Date Last Updated2020/08/03