Published:2016/05/26 Last Updated:2016/05/26
JVN#00460236
NetCommons vulnerable to privilege escalation
Overview
NetCommons contains a privilege escalation vulnerability.
Products Affected
- NetCommons2.4.2.1 and earlier versions
Description
NetCommons provided by the NetCommons Project contains a privilege escalation vulnerability.
Impact
A user with secretariat privileges ("CLERK") may create a user with (system) administrator privileges ("SYSTEM_ADMIN").
Solution
Update the Software
Update the software according to the information provided by the developer.
Vendor Status
| Vendor | Status | Last Update | Vendor Notes |
|---|---|---|---|
| NetCommons Project | Vulnerable | 2016/05/26 | NetCommons Project website |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
CVSS v3
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Base Score:
7.1
CVSS v2
AV:N/AC:L/Au:S/C:P/I:P/A:N
Base Score:
5.5
Credit
Satoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert | |
| JPCERT Reports | |
| CERT Advisory | |
| CPNI Advisory | |
| TRnotes | |
| CVE |
CVE-2016-4813 |
| JVN iPedia |
JVNDB-2016-000075 |