[Japanese]

JVNDB-2022-000088

TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich) vulnerable to ClassLoader manipulation

Overview

The past versions of TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich) are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability.
According to the developer, this vulnerability is caused by an improper input validation issue (CWE-20) in the binding mechanism of Spring MVC.

NTT DATA Corporation reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and NTT DATA Corporation coordinated under the Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 9.8 (Critical) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS V2 Severity:
Base Metrics 7.5 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
Affected Products


NTT DATA
  • TERASOLUNA Global Framework 1.0.0 (Public review version)
  • TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1

According to the developer, in the case where only Controller that accepts XML format requests is defined as Bean, TERASOLUNA Server Framework for Java (Rich) is not affected by this vulnerability.
Impact

By the application processing a specially crafted file, arbitrary code may be executed with the privileges of the application.
Solution

[Update the software]
Update the software to the latest version according to the information provided by the developer.
Note that, additional workarounds may be required depending on the system environment.
For more information, refer to the information provided by the developer.

[Apply the Workaround]
If an update cannot be applied, the developer recommends users applying the workaround.
For more information, refer to the information provided by the developer.
Vendor Information

NTT DATA FUJITSU
CWE (What is CWE?)

  1. Improper Input Validation(CWE-20) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2022-43484
References

  1. JVN : JVN#54728399
  2. National Vulnerability Database (NVD) : CVE-2022-43484
  3. Related document : Minor issue with fix for CVE 2010-1622 [SPR-11098] #15724
Revision History

  • [2022/11/14]
      Web page was published
  • [2024/06/06]
      References : Content was added

Date Public2022/11/14
Date First Published2022/11/14
Date Last Updated2024/06/06