jvndb - jvndb-2023-000011

JVNDB-2023-000011

Vulnerability from jvndb - Published: 2023-01-31 14:10 - Updated:2024-06-11 17:35

Severity ?

6.2 (Medium) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

SUSHIRO App for Android outputs sensitive information to the log file

Details

SUSHIRO App for Android provided by AKINDO SUSHIRO CO., LTD. outputs sensitive information to the log file (CWE-532).

References

Type

URL

	JVN	http://jvn.jp/en/jp/JVN84642320/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-22362
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-22362
	Information Exposure(CWE-200)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	AKINDO SUSHIRO CO., LTD.	Hong Kong SUSHIRO
	AKINDO SUSHIRO CO., LTD.	Singapore SUSHIRO
	AKINDO SUSHIRO CO., LTD.	SUSHIRO
	AKINDO SUSHIRO CO., LTD.	Taiwan SUSHIRO
	AKINDO SUSHIRO CO., LTD.	Thailand SUSHIRO

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000011.html",
  "dc:date": "2024-06-11T17:35+09:00",
  "dcterms:issued": "2023-01-31T14:10+09:00",
  "dcterms:modified": "2024-06-11T17:35+09:00",
  "description": "SUSHIRO App for Android provided by AKINDO SUSHIRO CO., LTD. outputs sensitive information to the log file (CWE-532).",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000011.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:akindo-sushiro:hong_kong_sushiro",
      "@product": "Hong Kong SUSHIRO",
      "@vendor": "AKINDO SUSHIRO CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:akindo-sushiro:singapore_sushiro",
      "@product": "Singapore SUSHIRO",
      "@vendor": "AKINDO SUSHIRO CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:akindo-sushiro:sushiro",
      "@product": "SUSHIRO",
      "@vendor": "AKINDO SUSHIRO CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:akindo-sushiro:taiwan_sushiro",
      "@product": "Taiwan SUSHIRO",
      "@vendor": "AKINDO SUSHIRO CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:akindo-sushiro:thailand_sushiro",
      "@product": "Thailand SUSHIRO",
      "@vendor": "AKINDO SUSHIRO CO., LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "4.9",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "6.2",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000011",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN84642320/index.html",
      "@id": "JVN#84642320",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22362",
      "@id": "CVE-2023-22362",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22362",
      "@id": "CVE-2023-22362",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "SUSHIRO App for Android outputs sensitive information to the log file"
}

CVE-2023-22362 (GCVE-0-2023-22362)

Vulnerability from cvelistv5 – Published: 2023-02-13 00:00 – Updated: 2025-03-21 14:32

Summary

SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information from the log file. Affected products/versions are as follows: SUSHIRO Ver.4.0.31, Thailand SUSHIRO Ver.1.0.0, Hong Kong SUSHIRO Ver.3.0.2, Singapore SUSHIRO Ver.2.0.0, and Taiwan SUSHIRO Ver.2.0.1

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

Insertion of sensitive information into log file

Assigner

jpcert

References

URL

Tags

	https://play.google.com/store/apps/details?id=jp.…
	https://play.google.com/store/apps/details?id=th.…
	https://play.google.com/store/apps/details?id=hk.…
	https://play.google.com/store/apps/details?id=sg.…
	https://play.google.com/store/apps/details?id=tw.…
	https://jvn.jp/en/jp/JVN84642320/

Impacted products

	Vendor	Product	Version
	AKINDO SUSHIRO CO., LTD.	SUSHIRO App for Android	Affected: SUSHIRO Ver.4.0.31, Thailand SUSHIRO Ver.1.0.0, Hong Kong SUSHIRO Ver.3.0.2, Singapore SUSHIRO Ver.2.0.0, and Taiwan SUSHIRO Ver.2.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:07:06.595Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://play.google.com/store/apps/details?id=jp.co.akindo_sushiro.sushiroapp"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://play.google.com/store/apps/details?id=th.co.akindo_sushiro.sushiroapp"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://play.google.com/store/apps/details?id=hk.co.akindo_sushiro.sushiroapp"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://play.google.com/store/apps/details?id=sg.co.akindo_sushiro.sushiroapp"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://play.google.com/store/apps/details?id=tw.co.akindo_sushiro.sushiroapp"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN84642320/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-22362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-21T14:30:48.588374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-532",
                "description": "CWE-532 Insertion of Sensitive Information into Log File",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-21T14:32:31.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SUSHIRO App for Android",
          "vendor": "AKINDO SUSHIRO CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "SUSHIRO Ver.4.0.31, Thailand SUSHIRO Ver.1.0.0, Hong Kong SUSHIRO Ver.3.0.2, Singapore SUSHIRO Ver.2.0.0, and Taiwan SUSHIRO Ver.2.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information from the log file. Affected products/versions are as follows: SUSHIRO Ver.4.0.31, Thailand SUSHIRO Ver.1.0.0, Hong Kong SUSHIRO Ver.3.0.2, Singapore SUSHIRO Ver.2.0.0, and Taiwan SUSHIRO Ver.2.0.1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Insertion of sensitive information into log file",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-13T00:00:00.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://play.google.com/store/apps/details?id=jp.co.akindo_sushiro.sushiroapp"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=th.co.akindo_sushiro.sushiroapp"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=hk.co.akindo_sushiro.sushiroapp"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=sg.co.akindo_sushiro.sushiroapp"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=tw.co.akindo_sushiro.sushiroapp"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN84642320/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-22362",
    "datePublished": "2023-02-13T00:00:00.000Z",
    "dateReserved": "2022-12-28T00:00:00.000Z",
    "dateUpdated": "2025-03-21T14:32:31.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

JVNDB-2023-000011

CVE-2023-22362 (GCVE-0-2023-22362)

Tags

Sightings

Nomenclature