|
[Japanese]
|
JVNDB-2020-000053
|
Multiple vulnerabilities in CyberMail
|
|
CyberMail contains multiple vulnerabilities listed below.
* Cross-site Scripting (CWE-79) - CVE-2020-5540
* Open Redirect (CWE-601) - CVE-2020-5541
Tony Kuo and Chia-Lung Hsieh of CHT Security reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 6.1 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
The above CVSS base scores have been assigned for CVE-2020-5540
|
CVSS V3 Severity:
Base Metrics:
4.7 (Medium) [IPA Score]
-
Attack Vector: Network
-
Attack Complexity: Low
-
Privileges Required: None
-
User Interaction: Required
-
Scope: Changed
-
Confidentiality Impact: None
-
Integrity Impact: Low
-
Availability Impact: None
CVSS V2 Severity:Base Metrics:
4.3 (Medium)
[IPA Score]
-
Access Vector: Network
-
Access Complexity: Medium
-
Authentication: None
-
Confidentiality Impact: None
-
Integrity Impact: Partial
-
Availability Impact: None
The above CVSS base scores have been assigned for CVE-2020-5541
|
|
|
CyberSolutions
- CyberMail Ver.6
- CyberMail Ver.7
|
|
|
* An arbitrary script may be executed on the user's web browser - CVE-2020-5540
* When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack - CVE-2020-5541
|
|
[Apply the Patch]
Apply the patch according to the information provided by the developer.
The developer has released the following patch for CyberMail Ver.7.x to address this vulnerability.
CyberMail 6.x is no longer supported (EOS), and there are no plans to release a patch for it.
* hotfix_cmv7sp3_200616
[Apply workarounds]
Applying workarounds may mitigate the impacts of these vulnerabilities.For the details, refer to the support documentation provided by the developer (Japanese Only) (Registered Users Only).
|
|
CyberSolutions
|
|
- Improper Input Validation(CWE-20) [IPA Evaluation]
- Cross-site Scripting(CWE-79) [IPA Evaluation]
|
|
- CVE-2020-5540
- CVE-2020-5541
|
|
- JVN : JVN#46258789
|
|
- [2020/08/11]
Web page was published
|
