Published:2019/12/10 Last Updated:2019/12/10
JVN#63047298
Kinza vulnerable to cross-site scripting
Overview
Kinza contains a cross-site scripting vulnerability.
Products Affected
- Kinza (for windows) version 5.9.2 and earlier
- Kinza (for Mac) version 5.0.0 and earlier
Description
Kinza provided by Dayz Inc. contains a cross-site scripting vulnerability (CWE-79).
Impact
If CSP (Content Security Policy) on the affected product is disabled, an arbitrary script may be executed on the web browser of the user who uses RSS reader.
Solution
Update the Software
Update to the latest version according to the information provided by the developer.
Apply a workaround
The following workaround may mitigate the affects of this vulnerability.
- Enable CSP
Vendor Status
| Vendor | Status | Last Update | Vendor Notes |
|---|---|---|---|
| Dayz Inc. | Vulnerable | 2019/12/10 | Dayz Inc. website |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
CVSS v3
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score:
6.1
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
CVSS v2
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score:
4.3
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
RyotaK reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2019-6031 |
| JVN iPedia |
JVNDB-2019-000073 |