JVN#84125369 Blogn vulnerable to cross-site request forgery

Overview

Blogn from R-ONE Computer contains a cross-site request forgery vulnerability.

Products Affected

Blogn v1.9.7 and earlier

Description

Blogn from R-ONE Computer is software for creating blogs. Blogn contains a cross-site request forgery vulnerability.

Impact

Contents created by Blogn may be editted or modified if the logged in user views a malicious web page.

Solution

Update the Software
Apply the latest update provided by the vendor.

Vendor Status

Vendor	Status	Last Update	Vendor Notes
Blogn	Vulnerable	2008/08/29

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2008.08.29

Measures	Conditions	Severity
Access Required	Routed - can be attacked over the Internet using packets	High
Authentication	None - anonymous or no authentication (IP addresses do not count)	High
User Interaction Required	Simple - the user must be convinced to take a standard action that does not feel harmful to most users, such as click on a link or view a file	Medium
Exploit Complexity	Low - little to no expertise and/or luck required to exploit (cross-site scripting)	High

Description of each analysis measures

Credit

Masako Ohno of NetAgent Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendor under Information Technology Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE	CVE-2008-3885
JVN iPedia	JVNDB-2008-000054