Published:2016/01/29  Last Updated:2016/01/29

JVN#03050861
EXPRESSCLUSTER X vulnerable to directory traversal

Overview

EXPRESSCLUSTER X provided by NEC Corporation contains a directory traversal vulnerability.

Products Affected

  • EXPRESSCLUSTER X 3.3 for Windows (Internal Ver. 11.31) or earlier
  • EXPRESSCLUSTER X 3.3 for Linux (Internal Ver. 3.3.1-1) or earlier
  • EXPRESSCLUSTER X 3.3 for Solaris (Internal Ver. 3.3.1-1) or earlier

Description

EXPRESSCLUSTER X from NEC Corporation is software to provide high availability (HA) clustering. EXPRESSCLUSTER X contains an issue in WebManager, which may lead to directory traversal.

Impact

Arbitrary files on the server may be viewed by an attacker who can access to the WebManager.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Apply a Workaround
The following workarounds may mitigate the affects of this vulnerability.

  • Enable access restriction by IP address
  • Enable access restriction by password

Vendor Status

Vendor Status Last Update Vendor Notes
NEC Corporation Vulnerable 2016/01/29 NEC Corporation website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 7.5
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:N/AC:L/Au:N/C:C/I:N/A:N
Base Score: 7.8
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Comment

Both CVSS v2 and CVSS v3 scores were analyzed under the assumption that any of those workarounds are not applied.

Credit

Yusuke SAKAI of Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2016-1145
JVN iPedia JVNDB-2016-000015