jvndb - jvndb-2023-000112

jvndb-2023-000112

Vulnerability from jvndb

Published

2023-11-13 15:57

Modified

2024-04-22 17:56

Severity ?

5.9 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

Multiple vulnerabilities in Pleasanter

Details

Pleasanter provided by Implem Inc. contains multiple vulnerabilities listed below. <ul><li>Stored cross-site scripting vulnerability (CWE-79) - CVE-2023-34439</li><li>Improper access control vulnerability (CWE-284) - CVE-2023-45210</li><li>Open redirect vulnerability (CWE-601) - CVE-2023-46688</li><li>Authentication bypass vulnerability by SAML (CWE-289) - CVE-2023-41890</li></ul> CVE-2023-41890 This issue is caused by a vulnerability in Sustainsys.Saml2 library used in the product. CVE-2023-34439,CVE-2023-45210 Sato Nobuhiro of Suzuki Motor Corporation and You Okuma of LAC Co., Ltd. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2023-46688 Yoichi Tsuzuki of FFRI Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Implem Inc. reported to IPA that CVE-2023-41890 vulnerability still exists in the product. JPCERT/CC coordinated with the developer.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN96209256/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-34439
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-45210
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-46688
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-41890
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-34439
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-41890
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-45210
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-46688
	Related Information	https://github.com/Sustainsys/Saml2/security/advisories/GHSA-fv2h-753j-9g39
	Permissions(CWE-264)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	Implem Inc.	Pleasanter

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000112.html",
  "dc:date": "2024-04-22T17:56+09:00",
  "dcterms:issued": "2023-11-13T15:57+09:00",
  "dcterms:modified": "2024-04-22T17:56+09:00",
  "description": "Pleasanter provided by Implem Inc. contains multiple vulnerabilities listed below.\r\n\u003cul\u003e\u003cli\u003eStored cross-site scripting vulnerability (CWE-79) - CVE-2023-34439\u003c/li\u003e\u003cli\u003eImproper access control vulnerability (CWE-284) - CVE-2023-45210\u003c/li\u003e\u003cli\u003eOpen redirect vulnerability (CWE-601) - CVE-2023-46688\u003c/li\u003e\u003cli\u003eAuthentication bypass vulnerability by SAML (CWE-289) - CVE-2023-41890\u003c/li\u003e\u003c/ul\u003e\r\nCVE-2023-41890\r\nThis issue is caused by a vulnerability in Sustainsys.Saml2 library used in the product.\r\n\r\nCVE-2023-34439,CVE-2023-45210\r\nSato Nobuhiro of Suzuki Motor Corporation and You Okuma of LAC Co., Ltd. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2023-46688\r\nYoichi Tsuzuki of FFRI Security, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nImplem Inc. reported to IPA that CVE-2023-41890 vulnerability still exists in the product. JPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000112.html",
  "sec:cpe": {
    "#text": "cpe:/a:pleasanter:pleasanter",
    "@product": "Pleasanter",
    "@vendor": "Implem Inc.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.9",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000112",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN96209256/index.html",
      "@id": "JVN#96209256",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-34439",
      "@id": "CVE-2023-34439",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-45210",
      "@id": "CVE-2023-45210",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-46688",
      "@id": "CVE-2023-46688",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-41890",
      "@id": "CVE-2023-41890",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-34439",
      "@id": "CVE-2023-34439",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-41890",
      "@id": "CVE-2023-41890",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-45210",
      "@id": "CVE-2023-45210",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-46688",
      "@id": "CVE-2023-46688",
      "@source": "NVD"
    },
    {
      "#text": "https://github.com/Sustainsys/Saml2/security/advisories/GHSA-fv2h-753j-9g39",
      "@id": "Insufficient Identity Provider Issuer Validation",
      "@source": "Related Information"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in Pleasanter"
}

cve-2023-41890

Vulnerability from cvelistv5

Published

2023-09-19 14:38

Modified

2024-10-15 18:32

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

References

▼	URL	Tags
	https://github.com/Sustainsys/Saml2/security/advisories/GHSA-fv2h-753j-9g39	x_refsource_CONFIRM
	https://github.com/Sustainsys/Saml2/issues/712	x_refsource_MISC
	https://github.com/Sustainsys/Saml2/issues/713	x_refsource_MISC

Impacted products

▼	Vendor	Product
	Sustainsys	Saml2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:09:49.378Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/Sustainsys/Saml2/security/advisories/GHSA-fv2h-753j-9g39",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Sustainsys/Saml2/security/advisories/GHSA-fv2h-753j-9g39"
          },
          {
            "name": "https://github.com/Sustainsys/Saml2/issues/712",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Sustainsys/Saml2/issues/712"
          },
          {
            "name": "https://github.com/Sustainsys/Saml2/issues/713",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Sustainsys/Saml2/issues/713"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:28:58.427263Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T18:32:14.776Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Saml2",
          "vendor": "Sustainsys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. \nPrior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity provider to craft a Saml2 response that is processed as if issued by another identity provider. It is also possible for a malicious end user to cause stored state intended for one identity provider to be used when processing the response from another provider. An application is impacted if they rely on any of these features in their authentication/authorization logic: the issuer of the generated identity and claims; or items in the stored request state (AuthenticationProperties). This issue is patched in versions 2.9.2 and 1.0.3. The `AcsCommandResultCreated` notification can be used to add the validation required if an upgrade to patched packages is not possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-289",
              "description": "CWE-289: Authentication Bypass by Alternate Name",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294: Authentication Bypass by Capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-19T14:38:55.861Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Sustainsys/Saml2/security/advisories/GHSA-fv2h-753j-9g39",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Sustainsys/Saml2/security/advisories/GHSA-fv2h-753j-9g39"
        },
        {
          "name": "https://github.com/Sustainsys/Saml2/issues/712",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Sustainsys/Saml2/issues/712"
        },
        {
          "name": "https://github.com/Sustainsys/Saml2/issues/713",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Sustainsys/Saml2/issues/713"
        }
      ],
      "source": {
        "advisory": "GHSA-fv2h-753j-9g39",
        "discovery": "UNKNOWN"
      },
      "title": "Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-41890",
    "datePublished": "2023-09-19T14:38:55.861Z",
    "dateReserved": "2023-09-04T16:31:48.225Z",
    "dateUpdated": "2024-10-15T18:32:14.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-45210

Vulnerability from cvelistv5

Published

2023-12-06 08:40

Modified

2024-08-02 20:14

Severity ?

Summary

Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files uploaded by other users who are not permitted to access.

References

▼	URL	Tags
	https://pleasanter.org/archives/vulnerability-update-202311
	https://jvn.jp/en/jp/JVN96209256/

Impacted products

▼	Vendor	Product
	Implem Inc.	Pleasanter

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:14:19.869Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pleasanter.org/archives/vulnerability-update-202311"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN96209256/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pleasanter",
          "vendor": "Implem Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.47.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files uploaded by other users who are not permitted to access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper access control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-06T08:40:41.155Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pleasanter.org/archives/vulnerability-update-202311"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN96209256/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-45210",
    "datePublished": "2023-12-06T08:40:41.155Z",
    "dateReserved": "2023-10-31T01:54:11.551Z",
    "dateUpdated": "2024-08-02T20:14:19.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-46688

Vulnerability from cvelistv5

Published

2023-12-06 08:40

Modified

2024-08-02 20:53

Severity ?

Summary

Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL.

References

▼	URL	Tags
	https://pleasanter.org/archives/vulnerability-update-202311
	https://jvn.jp/en/jp/JVN96209256/

Impacted products

▼	Vendor	Product
	Implem Inc.	Pleasanter

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:53:20.878Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pleasanter.org/archives/vulnerability-update-202311"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN96209256/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pleasanter",
          "vendor": "Implem Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.47.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Open Redirect",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-06T08:40:47.953Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pleasanter.org/archives/vulnerability-update-202311"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN96209256/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-46688",
    "datePublished": "2023-12-06T08:40:47.953Z",
    "dateReserved": "2023-10-31T01:54:10.690Z",
    "dateUpdated": "2024-08-02T20:53:20.878Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-34439

Vulnerability from cvelistv5

Published

2023-12-06 08:40

Modified

2024-08-02 16:10

Severity ?

Summary

Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser.

References

▼	URL	Tags
	https://pleasanter.org/archives/vulnerability-update-202311
	https://jvn.jp/en/jp/JVN96209256/

Impacted products

▼	Vendor	Product
	Implem Inc.	Pleasanter

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:10:07.263Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pleasanter.org/archives/vulnerability-update-202311"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN96209256/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pleasanter",
          "vendor": "Implem Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.47.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user\u0027s web browser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-06T08:40:53.373Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://pleasanter.org/archives/vulnerability-update-202311"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN96209256/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-34439",
    "datePublished": "2023-12-06T08:40:53.373Z",
    "dateReserved": "2023-10-31T01:54:12.452Z",
    "dateUpdated": "2024-08-02T16:10:07.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

jvndb-2023-000112

Vulnerability from jvndb

cve-2023-41890

Vulnerability from cvelistv5

cve-2023-45210

Vulnerability from cvelistv5

cve-2023-46688

Vulnerability from cvelistv5

cve-2023-34439

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature