cvelistv5 - CVE-2022-38400

CVE-2022-38400

Vulnerability from cvelistv5

Published

2022-09-08 07:10

Modified

2024-08-03 10:54

Severity ?

Summary

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL.

References

URL	Tags
vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN34205166/index.html	Third Party Advisory
vultures@jpcert.or.jp	https://www.synck.com/blogs/news/newsroom/detail_1661907555.html	Patch, Vendor Advisory
vultures@jpcert.or.jp	https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html	Exploit, Vendor Advisory
vultures@jpcert.or.jp	https://www.synck.com/downloads/cgi-perl/mailformpro/index.html	Product

Impacted products

▼	Vendor	Product
	SYNCK GRAPHICA	Mailform Pro CGI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:54:03.500Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.synck.com/blogs/news/newsroom/detail_1661907555.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN34205166/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Mailform Pro CGI",
          "vendor": "SYNCK GRAPHICA",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.1 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-08T07:10:47",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.synck.com/blogs/news/newsroom/detail_1661907555.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN34205166/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2022-38400",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Mailform Pro CGI",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.3.1 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SYNCK GRAPHICA"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Exposure of Sensitive Information to an Unauthorized Actor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.synck.com/blogs/news/newsroom/detail_1661907555.html",
              "refsource": "MISC",
              "url": "https://www.synck.com/blogs/news/newsroom/detail_1661907555.html"
            },
            {
              "name": "https://www.synck.com/downloads/cgi-perl/mailformpro/index.html",
              "refsource": "MISC",
              "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/index.html"
            },
            {
              "name": "https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html",
              "refsource": "MISC",
              "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN34205166/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN34205166/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-38400",
    "datePublished": "2022-09-08T07:10:47",
    "dateReserved": "2022-08-30T00:00:00",
    "dateUpdated": "2024-08-03T10:54:03.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-38400\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2022-09-08T08:15:08.293\",\"lastModified\":\"2023-08-08T14:22:24.967\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL.\"},{\"lang\":\"es\",\"value\":\"Mailform Pro CGI versiones 4.3.1 y anteriores permiten a un atacante remoto no autenticado obtener los datos de entrada del usuario utilizando el producto para acceder a una URL especialmente dise\u00f1ada\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:synck:mailform_pro_cgi:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.3.1\",\"matchCriteriaId\":\"2C4F0D41-6711-4DB0-9361-E6F9B0F6D65C\"}]}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN34205166/index.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.synck.com/blogs/news/newsroom/detail_1661907555.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://www.synck.com/downloads/cgi-perl/mailformpro/index.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Product\"]}]}}"
  }
}

CVE-2022-38400

Vulnerability from jvndb

Published

2022-09-05 15:22

Modified

2024-06-13 16:00

Severity ?

3.1 (Low) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Summary

SYNCK GRAPHICA Mailform Pro CGI vulnerable to information disclosure

Details

Mailform Pro CGI provided by SYNCK GRAPHICA contains an information disclosure vulnerability (CWE-200). Thanks module of this product saves user input data for a certain period of time. The time is set to 30 seconds by default in configs/thanks.cgi file. To exploit this vulerability, it is requireid for an attacker to access the affected product within in 30 seconds. Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	http://jvn.jp/en/jp/JVN34205166/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2022-38400
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2022-38400
	Information Exposure(CWE-200)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	SYNCK GRAPHICA	Mailform Pro CGI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000068.html",
  "dc:date": "2024-06-13T16:00+09:00",
  "dcterms:issued": "2022-09-05T15:22+09:00",
  "dcterms:modified": "2024-06-13T16:00+09:00",
  "description": "Mailform Pro CGI provided by SYNCK GRAPHICA contains an information disclosure vulnerability (CWE-200).\r\n\r\nThanks module of this product saves user input data for a certain period of time. The time is set to 30 seconds by default in configs/thanks.cgi file. To exploit this vulerability, it is requireid for an attacker to access the affected product within in 30 seconds.\r\n\r\nYuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000068.html",
  "sec:cpe": {
    "#text": "cpe:/a:synck_graphica:mailform_pro_cgi",
    "@product": "Mailform Pro CGI",
    "@vendor": "SYNCK GRAPHICA",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "3.1",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000068",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN34205166/index.html",
      "@id": "JVN#34205166",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-38400",
      "@id": "CVE-2022-38400",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-38400",
      "@id": "CVE-2022-38400",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "SYNCK GRAPHICA Mailform Pro CGI vulnerable to information disclosure"
}

gsd-2022-38400

Vulnerability from gsd

Modified

2023-12-13 01:19

Details

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL.

Aliases

CVE-2022-38400

Aliases

CVE-2022-38400

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-38400",
    "description": "Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL.",
    "id": "GSD-2022-38400"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-38400"
      ],
      "details": "Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL.",
      "id": "GSD-2022-38400",
      "modified": "2023-12-13T01:19:22.150630Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2022-38400",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Mailform Pro CGI",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "4.3.1 and earlier"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "SYNCK GRAPHICA"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Exposure of Sensitive Information to an Unauthorized Actor"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.synck.com/blogs/news/newsroom/detail_1661907555.html",
            "refsource": "MISC",
            "url": "https://www.synck.com/blogs/news/newsroom/detail_1661907555.html"
          },
          {
            "name": "https://www.synck.com/downloads/cgi-perl/mailformpro/index.html",
            "refsource": "MISC",
            "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/index.html"
          },
          {
            "name": "https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html",
            "refsource": "MISC",
            "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html"
          },
          {
            "name": "https://jvn.jp/en/jp/JVN34205166/index.html",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/jp/JVN34205166/index.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:synck:mailform_pro_cgi:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.3.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2022-38400"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-668"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Vendor Advisory"
              ],
              "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN34205166/index.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/en/jp/JVN34205166/index.html"
            },
            {
              "name": "https://www.synck.com/blogs/news/newsroom/detail_1661907555.html",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://www.synck.com/blogs/news/newsroom/detail_1661907555.html"
            },
            {
              "name": "https://www.synck.com/downloads/cgi-perl/mailformpro/index.html",
              "refsource": "MISC",
              "tags": [
                "Product"
              ],
              "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/index.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-09-14T13:59Z",
      "publishedDate": "2022-09-08T08:15Z"
    }
  }
}

ghsa-qq5j-v6jh-6xgc

Vulnerability from github

Published

2022-09-09 00:00

Modified

2022-09-15 00:00

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-38400"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-08T08:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL.",
  "id": "GHSA-qq5j-v6jh-6xgc",
  "modified": "2022-09-15T00:00:20Z",
  "published": "2022-09-09T00:00:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38400"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN34205166/index.html"
    },
    {
      "type": "WEB",
      "url": "https://www.synck.com/blogs/news/newsroom/detail_1661907555.html"
    },
    {
      "type": "WEB",
      "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1381250709.html"
    },
    {
      "type": "WEB",
      "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2022-38400

Vulnerability from cvelistv5

CVE-2022-38400

Vulnerability from jvndb

gsd-2022-38400

Vulnerability from gsd

ghsa-qq5j-v6jh-6xgc

Vulnerability from github

Tags

Sightings

Nomenclature