Published:2020/08/21  Last Updated:2020/08/21

JVN#88315581
Multiple cross-site scripting vulnerabilities in Exment

Overview

Exment provided by Kajitori Co.,Ltd contains multiple cross-site scripting vulnerabilities.

Products Affected

  • Exment prior to version v3.6.0

Description

Exment provided by Kajitori Co.,Ltd contains multiple cross-site scripting vulnerabilities listed below.

  • Stored cross-site scripting vulnerability in some input fields (CWE-79) - CVE-2020-5619
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
    CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5
  • Stored cross-site scripting vulnerability in upload files (CWE-79) - CVE-2020-5620
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
    CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5

Impact

An arbitrary script may be executed on a logged-in user's web browser.

Solution

Update the software
Update to the latest version according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
Kajitori Co.,Ltd Vulnerable 2020/08/21 Kajitori Co.,Ltd website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Ryoya Koyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2020-5619
CVE-2020-5620
JVN iPedia JVNDB-2020-000054