Published:2012/11/02 Last Updated:2012/11/02
JVN#52264310
MosP kintai kanri vulnerable to authentication bypass
Overview
MosP kintai kanri contains an authentication bypass vulnerability.
Products Affected
- MosP kintai kanri prior to V4.1.0
Description
MosP kintai kanri is an open source attendance management software. MosP kintai kanri contains an authentication bypass vulnerability.
Impact
An attacker with a MosP kintai kanri account may impersonate another user. As a result, information may be obtained and settings may be altered with the privilege of the user.
Solution
Update the software
Update to the latest version according to the information provided by the developer.
Vendor Status
| Vendor | Link |
| MIND CO.,LTD. | MosP top page (Japanese Only) |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Analyzed on 2012.11.02
| Measures | Conditions | Severity |
|---|---|---|
| Access Required | can be attacked over the Internet using packets |
|
| Authentication | login caused to be created by an administrator |
|
| User Interaction Required | the vulnerability can be exploited without an honest user taking any action |
|
| Exploit Complexity | the user must be convinced to take a difficult or suspicious action. If the honest user must have elevated privileges, they are likely to be more suspiciouse |
|
Credit
Masako Ohno reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert | |
| JPCERT Reports | |
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2012-4021 |
| JVN iPedia |
JVNDB-2012-000097 |