JVN#03050861
EXPRESSCLUSTER X vulnerable to directory traversal
Overview
EXPRESSCLUSTER X provided by NEC Corporation contains a directory traversal vulnerability.
Products Affected
- EXPRESSCLUSTER X 3.3 for Windows (Internal Ver. 11.31) or earlier
- EXPRESSCLUSTER X 3.3 for Linux (Internal Ver. 3.3.1-1) or earlier
- EXPRESSCLUSTER X 3.3 for Solaris (Internal Ver. 3.3.1-1) or earlier
Description
EXPRESSCLUSTER X from NEC Corporation is software to provide high availability (HA) clustering. EXPRESSCLUSTER X contains an issue in WebManager, which may lead to directory traversal.
Impact
Arbitrary files on the server may be viewed by an attacker who can access to the WebManager.
Solution
Update the Software
Update to the latest version according to the information provided by the developer.
Apply a Workaround
The following workarounds may mitigate the affects of this vulnerability.
- Enable access restriction by IP address
- Enable access restriction by password
Vendor Status
| Vendor | Status | Last Update | Vendor Notes |
|---|---|---|---|
| NEC Corporation | Vulnerable | 2016/01/29 | NEC Corporation website |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Comment
Both CVSS v2 and CVSS v3 scores were analyzed under the assumption that any of those workarounds are not applied.
Credit
Yusuke SAKAI of Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2016-1145 |
| JVN iPedia |
JVNDB-2016-000015 |