[Japanese]

JVNDB-2021-000067

voidtools "Everything" vulnerable to HTTP header injection

Overview

The HTTP server of Everything provided by voidtools contains an HTTP header injection vulnerability (CWE-644).

Kusano Kazuhiko reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 6.1 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 5.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


voidtools
  • Everything all versions of 1.0 (Everything 1.0 series)
  • Everything all versions of 1.1 (Everything 1.1 series)
  • Everything all versions of 1.2 (Everything 1.2 series)

According to the developer, the Lite version of the product does not include the HTTP server and therefore is not affected by this vulnerability.
Impact

On the web browser of a user who accessed a website which uses the product, an arbitrary script may be executed or the displayed page may be altered.
Solution

[Update the application]
Update the application to the latest version according to the information provided by the developer.

[Use Everything Lite version]
The developer recommends using Everything Lite version, if there is no need to use the HTTP server.
Vendor Information

voidtools
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2021-20784
References

  1. JVN : JVN#68971465
  2. National Vulnerability Database (NVD) : CVE-2021-20784
Revision History

  • [2021/07/09]
      Web page was published
  • [2022/10/26]  
      Affected Products : Product version was modified 
      Affected Products : Content was modified
      Solution was modified

Date Public2021/07/09
Date First Published2021/07/09
Date Last Updated2021/07/09