JVN#07679150
ApeosWare Management Suite and ApeosWare Management Suite 2 contain open redirect vulnerability
Overview
ApeosWare Management Suite and ApeosWare Management Suite 2 contain an open redirect vulnerability.
Products Affected
- ApeosWare Management Suite Ver.1.4.0.18 and earlier
- ApeosWare Management Suite 2 Ver.2.1.2.4 and earlier
Description
ApeosWare Management Suite and ApeosWare Management Suite 2 provided by Fuji Xerox Co.,Ltd. are software products to manage devices and their usages; providing authentication, printing, log accounting, and document distribution.
These software products contain an open redirect vulnerability (CWE-601).
Impact
The user may be redirected to an arbitrary website when logging in to the product via a crafted URL or accessing a specially crafted URL while logged in to the product.
Solution
Apply the Patch
Apply the patch according to the information provided by the developer.
Vendor Status
| Vendor | Status | Last Update | Vendor Notes |
|---|---|---|---|
| Fuji Xerox Co.,Ltd. | Vulnerable | 2021/04/07 | Fuji Xerox Co.,Ltd. website |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
KOBAYASHI Haruki of Cryptography Laboratory, Department of Information and Communication Engineering, Graduate School of Tokyo Denki University and NAKAMURA Dai of Cryptography Laboratory, Department of Information and Communication Engineering, Tokyo Denki University reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2019-6004 |
| JVN iPedia |
JVNDB-2019-000052 |
Update History
- 2019/08/20
- Fuji Xerox Co.,Ltd. update status
- 2021/04/07
- Fuji Xerox Co.,Ltd. update status