JVN#36339873: dopvSTAR* vulnerable to cross-site scripting

Overview

dopvSTAR* contains a cross-site scripting vulnerability.

dopvSTAR* containing JavaScript that enables to log accesses, which had been available on bayashi.net until January 7, 2013

dopvSTAR* provided by bayashi.net is a software to analyze web access logs. dopvSTAR* contains a cross-site scripting vulnerability.

An arbitrary script may be executed on the user's web browser.

Modify the JavaScript
Modify the JavaScript that enables to log accesses, according to the information provided by the developer.

Vendor	Link
bayashi.net	dopvSTAR*

Analyzed on 2013.02.28

Measures	Conditions	Severity
Access Required	can be attacked over the Internet using packets	High
Authentication	anonymous or no authentication (IP addresses do not count)	High
User Interaction Required	the user must be convinced to take a standard action that does not feel harmful to most users, such as click on a link or view a file	Mid
Exploit Complexity	little to no expertise and/or luck required to exploit (cross-side scripting).Expected to be the common response	High

Masahiro YAMADA reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.