{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000078.html",
  "dc:date": "2024-05-30T17:57+09:00",
  "dcterms:issued": "2022-10-11T17:49+09:00",
  "dcterms:modified": "2024-05-30T17:57+09:00",
  "description": "bingo!CMS provided by Shift Tech Inc. contains an authentication bypass vulnerability (CWE-288) in some of the management functions.\r\nShift Tech Inc. states that attacks exploiting this vulnerability have been observed.\r\n\r\nShift Tech Inc. reported this vulnerability to IPA to notify users of its solution through JVN.\r\nJPCERT/CC and Shift Tech Inc. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000078.html",
  "sec:cpe": {
    "#text": "cpe:/a:shift-tech:bingo%21cms",
    "@product": "bingo!CMS",
    "@vendor": "Shift Tech Inc.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000078",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN74592196/index.html",
      "@id": "JVN#74592196",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-42458",
      "@id": "CVE-2022-42458",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-42458",
      "@id": "CVE-2022-42458",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/security/ciadr/vul/20221011-jvn.html",
      "@id": "Security Updates Available for bingo!CMS (JVN#74592196)",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "https://www.jpcert.or.jp/english/at/2022/at220026.html",
      "@id": "JPCERT-AT-2022-0026",
      "@source": "JPCERT"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-287",
      "@title": "Improper Authentication(CWE-287)"
    }
  ],
  "title": "bingo!CMS vulnerable to authentication bypass"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T13:10:40.834Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bingo-cms.jp/information/20221011.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN74592196/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "bingo!CMS",
          "vendor": "Shift Tech Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "version1.7.4.1 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to upload an arbitrary file. As a result, an arbitrary script may be executed and/or a file may be altered."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-07T00:00:00",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.bingo-cms.jp/information/20221011.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN74592196/index.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-42458",
    "datePublished": "2022-12-07T00:00:00",
    "dateReserved": "2022-10-07T00:00:00",
    "dateUpdated": "2024-08-03T13:10:40.834Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}