Action not permitted
Modal body text goes here.
cve-2023-37562
Vulnerability from cvelistv5
Published
2023-07-13 02:55
Modified
2024-08-02 17:16
Severity
Summary
Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed.
References
Source | URL | Tags |
---|---|---|
vultures@jpcert.or.jp | https://jvn.jp/en/jp/JVN05223215/ | Third Party Advisory |
vultures@jpcert.or.jp | https://www.elecom.co.jp/news/security/20230711-01/ | Vendor Advisory |
Impacted products
Vendor | Product |
---|---|
ELECOM CO.,LTD. | WTC-C1167GC-B |
ELECOM CO.,LTD. | WTC-C1167GC-W |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T17:16:30.896Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://www.elecom.co.jp/news/security/20230711-01/" }, { "tags": [ "x_transferred" ], "url": "https://jvn.jp/en/jp/JVN05223215/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "WTC-C1167GC-B", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.17 and earlier" } ] }, { "product": "WTC-C1167GC-W", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.17 and earlier" } ] } ], "descriptions": [ { "lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed." } ], "problemTypes": [ { "descriptions": [ { "description": "Cross-site request forgery (CSRF)", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2023-07-13T02:55:50.990Z", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert" }, "references": [ { "url": "https://www.elecom.co.jp/news/security/20230711-01/" }, { "url": "https://jvn.jp/en/jp/JVN05223215/" } ] } }, "cveMetadata": { "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2023-37562", "datePublished": "2023-07-13T02:55:50.990Z", "dateReserved": "2023-07-07T08:46:11.998Z", "dateUpdated": "2024-08-02T17:16:30.896Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-37562\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2023-07-13T03:15:09.880\",\"lastModified\":\"2023-07-25T14:03:42.807\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:elecom:wtc-c1167gc-b_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.17\",\"matchCriteriaId\":\"F0E26C65-3BC9-444D-A6D4-EDC76105A388\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:elecom:wtc-c1167gc-b:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B6FB5F1-64E0-4289-9445-79832CEEE039\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:elecom:wtc-c1167gc-w_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.17\",\"matchCriteriaId\":\"8024FCCD-77ED-48FE-8821-474F3A80D40A\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:elecom:wtc-c1167gc-w:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C416DBF4-851E-4058-A66E-31D711454370\"}]}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN05223215/\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.elecom.co.jp/news/security/20230711-01/\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
ghsa-ww8f-jpp6-679f
Vulnerability from github
Published
2023-07-13 03:30
Modified
2024-04-04 06:06
Severity
Details
Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed.
{ "affected": [], "aliases": [ "CVE-2023-37562" ], "database_specific": { "cwe_ids": [ "CWE-352" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-13T03:15:09Z", "severity": "HIGH" }, "details": "Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed.", "id": "GHSA-ww8f-jpp6-679f", "modified": "2024-04-04T06:06:17Z", "published": "2023-07-13T03:30:48Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37562" }, { "type": "WEB", "url": "https://jvn.jp/en/jp/JVN05223215" }, { "type": "WEB", "url": "https://www.elecom.co.jp/news/security/20230711-01" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
cve-2023-37562
Vulnerability from jvndb
Published
2023-07-11 15:37
Modified
2024-03-29 15:28
Severity
Summary
Multiple vulnerabilities in multiple ELECOM wireless LAN routers and wireless LAN repeaters
Details
Wireless LAN routers and wireless LAN repeaters provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.
* Cross-site Scripting (CWE-79) - CVE-2023-37560
* Open Redirect (CWE-601) - CVE-2023-37561
* Cross-Site Request Forgery (CWE-352) - CVE-2023-37562
* Information disclosure (CWE-200) - CVE-2023-37563
* OS Command Injection (CWE-78) - CVE-2023-37564
* Code Injection (CWE-94) - CVE-2023-37565
CVE-2023-37560
Yamaguchi Kakeru reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2023-37561, CVE-2023-37562
Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2023-37563
Shu Yoshikoshi reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC during the same period, and JPCERT/CC coordinated with the developer.
CVE-2023-37564
Shu Yoshikoshi reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2023-37565
MASAHIRO IIDA and SHUTA IDE of LAC Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000071.html", "dc:date": "2024-03-29T15:28+09:00", "dcterms:issued": "2023-07-11T15:37+09:00", "dcterms:modified": "2024-03-29T15:28+09:00", "description": "Wireless LAN routers and wireless LAN repeaters provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.\r\n\r\n * Cross-site Scripting (CWE-79) - CVE-2023-37560\r\n * Open Redirect (CWE-601) - CVE-2023-37561\r\n * Cross-Site Request Forgery (CWE-352) - CVE-2023-37562\r\n * Information disclosure (CWE-200) - CVE-2023-37563\r\n * OS Command Injection (CWE-78) - CVE-2023-37564\r\n * Code Injection (CWE-94) - CVE-2023-37565\r\n\r\nCVE-2023-37560\r\nYamaguchi Kakeru reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2023-37561, CVE-2023-37562\r\nKentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2023-37563\r\nShu Yoshikoshi reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\nChuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC during the same period, and JPCERT/CC coordinated with the developer.\r\n\r\nCVE-2023-37564\r\nShu Yoshikoshi reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2023-37565\r\nMASAHIRO IIDA and SHUTA IDE of LAC Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.", "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000071.html", "sec:cpe": [ { "#text": "cpe:/o:elecom:wrc-1167febk-a_firmware", "@product": "WRC-1167FEBK-A", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1167febk-s", "@product": "WRC-1167FEBK-S", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1167gebk-s_firmware", "@product": "WRC-1167GEBK-S", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1167ghbk-s_firmware", "@product": "WRC-1167GHBK-S", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1167ghbk3-a_firmware", "@product": "WRC-1167GHBK3-A", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrh-300wh-h_firmware", "@product": "WRH-300WH-H firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wtc-300hwh", "@product": "WTC-300HWH", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wtc-c1167gc-b", "@product": "WTC-C1167GC-B", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wtc-c1167gc-w", "@product": "WTC-C1167GC-W", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" } ], "sec:cvss": [ { "@score": "7.7", "@severity": "High", "@type": "Base", "@vector": "AV:A/AC:L/Au:S/C:C/I:C/A:C", "@version": "2.0" }, { "@score": "6.8", "@severity": "Medium", "@type": "Base", "@vector": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "@version": "3.0" } ], "sec:identifier": "JVNDB-2023-000071", "sec:references": [ { "#text": "http://jvn.jp/en/jp/JVN05223215/index.html", "@id": "JVN#05223215", "@source": "JVN" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-37560", "@id": "CVE-2023-37560", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-37561", "@id": "CVE-2023-37561", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-37562", "@id": "CVE-2023-37562", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-37563", "@id": "CVE-2023-37563", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-37564", "@id": "CVE-2023-37564", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-37565", "@id": "CVE-2023-37565", "@source": "CVE" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-37560", "@id": "CVE-2023-37560", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-37561", "@id": "CVE-2023-37561", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-37562", "@id": "CVE-2023-37562", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-37563", "@id": "CVE-2023-37563", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-37564", "@id": "CVE-2023-37564", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-37565", "@id": "CVE-2023-37565", "@source": "NVD" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-200", "@title": "Information Exposure(CWE-200)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-352", "@title": "Cross-Site Request Forgery(CWE-352)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-78", "@title": "OS Command Injection(CWE-78)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-79", "@title": "Cross-site Scripting(CWE-79)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-94", "@title": "Code Injection(CWE-94)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-Other", "@title": "No Mapping(CWE-Other)" } ], "title": "Multiple vulnerabilities in multiple ELECOM wireless LAN routers and wireless LAN repeaters" }
var-202307-0619
Vulnerability from variot
Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed. None
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202307-0619", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "wtc-c1167gc-b", "scope": "lte", "trust": 1.0, "vendor": "elecom", "version": "1.17" }, { "model": "wtc-c1167gc-w", "scope": "lte", "trust": 1.0, "vendor": "elecom", "version": "1.17" }, { "model": "wrc-600ghbk-a", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrc-1167ghbk-s", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrc-733febk2-a", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrc-f1167acf", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wtc-300hwh", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrc-1167ghbk3-a", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wtc-c1167gc-w", "scope": "lte", "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": "v1.17 and earlier s (cve-2023-37561,cve-2023-37562)" }, { "model": "wrc-1900ghbk-a", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrc-1167febk-a", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrc-1467ghbk-a", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrc-1167gebk-s", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrc-1167febk-s", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrc-1467ghbk-s", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrh-300wh-h", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wtc-c1167gc-b", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null }, { "model": "wrc-1900ghbk-s", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30ec\u30b3\u30e0\u682a\u5f0f\u4f1a\u793e", "version": null } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2023-000071" }, { "db": "NVD", "id": "CVE-2023-37562" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:elecom:wtc-c1167gc-b_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.17", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:elecom:wtc-c1167gc-b:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:elecom:wtc-c1167gc-w_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.17", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:elecom:wtc-c1167gc-w:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2023-37562" } ] }, "cve": "CVE-2023-37562", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": null, "accessComplexity": "High", "accessVector": "Network", "authentication": "None", "author": "IPA", "availabilityImpact": "None", "baseScore": 2.6, "confidentialityImpact": "None", "explitabilityScore": null, "id": "JVNDB-2023-000071", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Low", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "IPA", "availabilityImpact": "None", "baseScore": 4.3, "baseSeverity": "Medium", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "JVNDB-2023-000071", "impactScore": null, "integrityImpact": "Low", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "Required", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2023-37562", "trust": 1.0, "value": "HIGH" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2023-000071" }, { "db": "NVD", "id": "CVE-2023-37562" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed. None", "sources": [ { "db": "NVD", "id": "CVE-2023-37562" }, { "db": "JVNDB", "id": "JVNDB-2023-000071" }, { "db": "VULMON", "id": "CVE-2023-37562" } ], "trust": 1.71 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2023-37562", "trust": 3.3 }, { "db": "JVN", "id": "JVN05223215", "trust": 2.5 }, { "db": "JVNDB", "id": "JVNDB-2023-000071", "trust": 1.4 }, { "db": "CNNVD", "id": "CNNVD-202307-951", "trust": 0.6 }, { "db": "VULMON", "id": "CVE-2023-37562", "trust": 0.1 } ], "sources": [ { "db": "VULMON", "id": "CVE-2023-37562" }, { "db": "JVNDB", "id": "JVNDB-2023-000071" }, { "db": "CNNVD", "id": "CNNVD-202307-951" }, { "db": "NVD", "id": "CVE-2023-37562" } ] }, "id": "VAR-202307-0619", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.6666667 }, "last_update_date": "2024-03-29T22:36:08.241000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "wireless LAN Request for firmware update to improve router/repeater security ELECOM CO., LTD.", "trust": 0.8, "url": "https://www.elecom.co.jp/news/security/20230711-01/" }, { "title": "ELECOM WTC-C1167GC-B Security vulnerabilities", "trust": 0.6, "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=246119" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2023-000071" }, { "db": "CNNVD", "id": "CNNVD-202307-951" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-352", "trust": 1.0 }, { "problemtype": "OS Command injection (CWE-78) [IPA evaluation ]", "trust": 0.8 }, { "problemtype": " Cross-site scripting (CWE-79) [IPA evaluation ]", "trust": 0.8 }, { "problemtype": " Code injection (CWE-94) [IPA evaluation ]", "trust": 0.8 }, { "problemtype": " information leak (CWE-200) [IPA evaluation ]", "trust": 0.8 }, { "problemtype": " Cross-site request forgery (CWE-352) [IPA evaluation ]", "trust": 0.8 }, { "problemtype": " others (CWE-Other) [IPA evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2023-000071" }, { "db": "NVD", "id": "CVE-2023-37562" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "https://www.elecom.co.jp/news/security/20230711-01/" }, { "trust": 1.7, "url": "https://jvn.jp/en/jp/jvn05223215/" }, { "trust": 0.8, "url": "https://jvn.jp/jp/jvn05223215/index.html" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-37560" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-37561" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-37562" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-37563" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-37564" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2023-37565" }, { "trust": 0.6, "url": "https://jvndb.jvn.jp/en/contents/2023/jvndb-2023-000071.html" }, { "trust": 0.6, "url": "https://cxsecurity.com/cveshow/cve-2023-37562/" }, { "trust": 0.1, "url": "https://nvd.nist.gov" } ], "sources": [ { "db": "VULMON", "id": "CVE-2023-37562" }, { "db": "JVNDB", "id": "JVNDB-2023-000071" }, { "db": "CNNVD", "id": "CNNVD-202307-951" }, { "db": "NVD", "id": "CVE-2023-37562" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULMON", "id": "CVE-2023-37562" }, { "db": "JVNDB", "id": "JVNDB-2023-000071" }, { "db": "CNNVD", "id": "CNNVD-202307-951" }, { "db": "NVD", "id": "CVE-2023-37562" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-07-13T00:00:00", "db": "VULMON", "id": "CVE-2023-37562" }, { "date": "2023-07-11T00:00:00", "db": "JVNDB", "id": "JVNDB-2023-000071" }, { "date": "2023-07-11T00:00:00", "db": "CNNVD", "id": "CNNVD-202307-951" }, { "date": "2023-07-13T03:15:09.880000", "db": "NVD", "id": "CVE-2023-37562" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-07-13T00:00:00", "db": "VULMON", "id": "CVE-2023-37562" }, { "date": "2024-03-29T06:15:00", "db": "JVNDB", "id": "JVNDB-2023-000071" }, { "date": "2023-07-14T00:00:00", "db": "CNNVD", "id": "CNNVD-202307-951" }, { "date": "2023-07-25T14:03:42.807000", "db": "NVD", "id": "CVE-2023-37562" } ] }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Elecom radio \u00a0LAN\u00a0 router and wireless \u00a0LAN\u00a0 Multiple vulnerabilities in repeaters", "sources": [ { "db": "JVNDB", "id": "JVNDB-2023-000071" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "other", "sources": [ { "db": "CNNVD", "id": "CNNVD-202307-951" } ], "trust": 0.6 } }
gsd-2023-37562
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2023-37562", "id": "GSD-2023-37562" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2023-37562" ], "details": "Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed.", "id": "GSD-2023-37562", "modified": "2023-12-13T01:20:24.824241Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2023-37562", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "WTC-C1167GC-B", "version": { "version_data": [ { "version_affected": "=", "version_value": "v1.17 and earlier" } ] } }, { "product_name": "WTC-C1167GC-W", "version": { "version_data": [ { "version_affected": "=", "version_value": "v1.17 and earlier" } ] } } ] }, "vendor_name": "ELECOM CO.,LTD." } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Cross-site request forgery (CSRF)" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.elecom.co.jp/news/security/20230711-01/", "refsource": "MISC", "url": "https://www.elecom.co.jp/news/security/20230711-01/" }, { "name": "https://jvn.jp/en/jp/JVN05223215/", "refsource": "MISC", "url": "https://jvn.jp/en/jp/JVN05223215/" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:elecom:wtc-c1167gc-b_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.17", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:elecom:wtc-c1167gc-b:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:elecom:wtc-c1167gc-w_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.17", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:elecom:wtc-c1167gc-w:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2023-37562" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-352" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.elecom.co.jp/news/security/20230711-01/", "refsource": "MISC", "tags": [ "Vendor Advisory" ], "url": "https://www.elecom.co.jp/news/security/20230711-01/" }, { "name": "https://jvn.jp/en/jp/JVN05223215/", "refsource": "MISC", "tags": [ "Third Party Advisory" ], "url": "https://jvn.jp/en/jp/JVN05223215/" } ] } }, "impact": { "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 5.9 } }, "lastModifiedDate": "2023-07-25T14:03Z", "publishedDate": "2023-07-13T03:15Z" } } }
Loading...