|
[Japanese]
|
JVNDB-2023-000058
|
Pleasanter vulnerable to cross-site scripting
|
|
Pleasanter provided by Implem Inc. contains a cross-site scripting vulnerability (CWE-79).
Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to Implem Inc. and Implem Inc. reported it to IPA.
JPCERT/CC and Implem Inc. coordinated under the Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 5.4 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
CVSS V2 Severity:
Base Metrics 3.5 (Low) [IPA Score]
- Access Vector: Network
- Access Complexity: Medium
- Authentication: Single Instance
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
Implem Inc.
- Pleasanter all versions of 1.3.38.1 and earlier
|
The developer states that both Community Edition and Enterprise Edition are affected.
|
|
An arbitrary script may be executed on a logged-in user's web browser.
|
|
[Update the software or apply the patch]
Update the software to the latest version according to the information provided by the developer.
For the users who cannot update the software, the developer has released the patch for version 1.3.X as an alternative countermeasure.
For more information, refer to the information provided by the developer.
|
|
Implem Inc.
|
|
- Cross-site Scripting(CWE-79) [IPA Evaluation]
|
|
- CVE-2023-30758
|
|
- JVN : JVN#62111727
- National Vulnerability Database (NVD) : CVE-2023-30758
|
|
- [2023/05/31]
Web page was published
- [2024/03/19]
References : Content was added
|
