jvndb - jvndb-2025-000005

JVNDB-2025-000005

Vulnerability from jvndb - Published: 2025-01-27 14:25 - Updated:2025-01-27 14:25

Severity ?

6.1 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

EXIF Viewer Classic vulnerable to cross-site scripting

Details

EXIF Viewer Classic provided by Rodrigue (former Kakera) is a Google Chrome browser extension. The affected versions of the product improperly handle EXIF meta data, resulting in a cross-site scripting vulnerability (CWE-79). Versions 2.3.2 and 2.4.0 were reported as vulnerable. The vendor informs us that the product has been refactored after those old versions and that the current version 3.0.1 is not vulnerable. Yuji Tounai of Mitsui Bussan Secure Directions, Inc. and Kouhei Morita reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN05508012/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-23362
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

Rodrigue

EXIF Viewer Classic

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000005.html",
  "dc:date": "2025-01-27T14:25+09:00",
  "dcterms:issued": "2025-01-27T14:25+09:00",
  "dcterms:modified": "2025-01-27T14:25+09:00",
  "description": "EXIF Viewer Classic provided by Rodrigue (former Kakera) is a Google Chrome browser extension.\r\nThe affected versions of the product improperly handle EXIF meta data, resulting in a cross-site scripting vulnerability (CWE-79).\r\n\r\nVersions 2.3.2 and 2.4.0 were reported as vulnerable. The vendor informs us that the product has been refactored after those old versions and that the current version 3.0.1 is not vulnerable.\r\n\r\nYuji Tounai of Mitsui Bussan Secure Directions, Inc. and Kouhei Morita reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000005.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:rodrigue_exif_viewer_classic",
    "@product": "EXIF Viewer Classic",
    "@vendor": "Rodrigue",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.1",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000005",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN05508012/index.html",
      "@id": "JVN#05508012",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-23362",
      "@id": "CVE-2025-23362",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EXIF Viewer Classic vulnerable to cross-site scripting"
}

CVE-2025-23362 (GCVE-0-2025-23362)

Vulnerability from cvelistv5 – Published: 2025-01-29 01:53 – Updated: 2025-02-12 19:51

Summary

The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an image is rendered and crafted EXIF meta data is processed, an arbitrary script may be executed on the web browser. Versions 2.3.2 and 2.4.0 were reported as vulnerable. According to the vendor, the product has been refactored after those old versions and the version 3.0.1 is not vulnerable.

Severity ?

6.1 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Cross-site scripting (XSS)

Assigner

jpcert

References

URL

Tags

	https://chromewebstore.google.com/detail/exif-vie…
	https://exifviewers.com/
	https://jvn.jp/en/jp/JVN05508012/

Impacted products

	Vendor	Product	Version
	Rodrigue	EXIF Viewer Classic	Affected: 2.4.0 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-23362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T14:53:19.034616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:51:15.739Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EXIF Viewer Classic",
          "vendor": "Rodrigue",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.0 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an image is rendered and crafted EXIF meta data is processed, an arbitrary script may be executed on the web browser. Versions 2.3.2 and 2.4.0 were reported as vulnerable. According to the vendor, the product has been refactored after those old versions and the version 3.0.1 is not vulnerable."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-29T01:53:57.630Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://chromewebstore.google.com/detail/exif-viewer-classic/nafpfdcmppffipmhcpkbplhkoiekndck"
        },
        {
          "url": "https://exifviewers.com/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN05508012/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-23362",
    "datePublished": "2025-01-29T01:53:57.630Z",
    "dateReserved": "2025-01-14T08:31:38.228Z",
    "dateUpdated": "2025-02-12T19:51:15.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

JVNDB-2025-000005

CVE-2025-23362 (GCVE-0-2025-23362)

Tags

Sightings

Nomenclature