{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000018.html",
  "dc:date": "2023-11-16T15:41+09:00",
  "dcterms:issued": "2021-03-05T17:03+09:00",
  "dcterms:modified": "2023-11-16T15:41+09:00",
  "description": "The installers of E START products by GMO INSIGHT Inc. contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries in the folder specified by the TEMP environment variable or where the installer resides (CWE-427, CVE-2015-9267, and CVE-2015-9268).\r\n\r\nBlackWingCat of PinkFlyingWhale reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000018.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:misc:gmo_insight_e_start_app",
      "@product": "E START App",
      "@vendor": "GMO insight Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:gmo_insight_e_start_update_center",
      "@product": "E START Update Center",
      "@vendor": "GMO insight Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000018",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/ta/JVNTA91240916/index.html",
      "@id": "JVNTA#91240916",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/jp/JVN68418039/index.html",
      "@id": "JVN#68418039",
      "@source": "JVN"
    },
    {
      "#text": "http://jvn.jp/vu/JVNVU99774191/index.html",
      "@id": "JVNVU#99774191",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9267",
      "@id": "CVE-2015-9267",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9268",
      "@id": "CVE-2015-9268",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2015-9267",
      "@id": "CVE-2015-9267",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2015-9268",
      "@id": "CVE-2015-9268",
      "@source": "NVD"
    },
    {
      "#text": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-02",
      "@id": "ICSA-23-318-02",
      "@source": "ICS-CERT ADVISORY"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "The installers of E START products may insecurely load Dynamic Link Libraries"
}