[Japanese]

JVNDB-2022-000024

Zero-channel BBS Plus vulnerable to cross-site scripting

Overview

Zero-channel BBS Plus by Zero-Channel BBS Plus Developers is a bulletin board CGI script. Zero-channel BBS Plus contains a cross-site scripting vulnerability (CWE-79).

Zero-Channel BBS Plus Developers reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Zero-Channel BBS Plus Developers coordinated under the Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 6.1 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


Zero-Channel BBS Plus Developers
  • Zero-channel BBS Plus v0.7.4 and earlier

Impact

An arbitrary script may be executed on the web browser of the user who is accessing the management screen of the product, which may lead to the creation of a management account. As a result, a remote attacker may view the sender's information on the bulletin board, change the settings, edit/delete the posts.
Solution

[Update the Software]
Update the software to the latest version according to the information provided by the developer.
Vendor Information

Zero-Channel BBS Plus Developers
CWE (What is CWE?)

  1. Cross-site Scripting(CWE-79) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2022-27496
References

  1. JVN : JVN#59576930
Revision History

  • [2022/03/30]
      Web page was published

Date Public2022/03/30
Date First Published2022/03/30
Date Last Updated2022/03/30