[Japanese]

JVNDB-2023-000043

Multiple vulnerabilities in MicroEngine Mailform

Overview

MicroEngine Mailform provided by MicroEngine Inc. contains multiple vulnerabilities listed below.
  • Unrestricted upload of file with dangerous type (CWE-434) - CVE-2023-27397
  • Path traversal (CWE-22) - CVE-2023-27507
Yuji Tounai of Mitsui Bussan Secure Directions, Inc. and hibiki moriyama of STNet, Incorporated reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 3.7 (Low) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2023-27397

CVSS V3 Severity:
Base Metrics 3.7 (Low) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2023-27507
Affected Products


MicroEngine Inc.
  • MicroEngine Mailform version 1.1.0 to 1.1.8

Impact

If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it.
Solution

[Update the Software]
Update to version 1.1.9 or later according to the information provided by the developer.

[Apply workarounds]
The developer also provides the workaround information regarding this issue.

For more information, refer to the information provided by the developer.
Vendor Information

MicroEngine Inc.
CWE (What is CWE?)

  1. Path Traversal(CWE-22) [IPA Evaluation]
  2. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2023-27397
  2. CVE-2023-27507
References

  1. JVN : JVN#31701509
  2. National Vulnerability Database (NVD) : CVE-2023-27397
  3. National Vulnerability Database (NVD) : CVE-2023-27507
Revision History

  • [2023/05/10]
      Web page was published
  • [2024/05/24]
      References : Contents were added  

Date Public2023/05/10
Date First Published2023/05/10
Date Last Updated2024/05/24