Published:2017/01/06  Last Updated:2017/01/06

JVN#71538099
Olive Diary DX vulnerable to cross-site scripting

Overview

Olive Diary DX contains a cross-site scripting vulnerability.

Products Affected

  • Olive Diary DX

Description

Olive Diary DX provided by Olive Design contains a cross-site scripting vulnerability (CWE-79) due to a flaw in processing the page parameter.

Impact

An artbitrary script may be executed on the user's web browser.

Solution

Do not use Olive Diary DX
Olive Diary DX is no longer being developed or maintained. It is recommended to stop using Olive Diary DX.

Vendor Status

Vendor Status Last Update Vendor Notes
Olive Design Vulnerable 2017/01/06

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score: 6.1
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score: 4.3
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Credit

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2016-7841
JVN iPedia JVNDB-2017-000003