Published:2019/08/15  Last Updated:2019/08/20

JVN#07679150
ApeosWare Management Suite and ApeosWare Management Suite 2 contain open redirect vulnerability

Overview

ApeosWare Management Suite and ApeosWare Management Suite 2 contain an open redirect vulnerability.

Products Affected

  • ApeosWare Management Suite Ver.1.4.0.18 and earlier
  • ApeosWare Management Suite 2 Ver.2.1.2.4 and earlier

Description

ApeosWare Management Suite and ApeosWare Management Suite 2 provided by Fuji Xerox Co.,Ltd. are software products to manage devices and their usages; providing authentication, printing, log accounting, and document distribution.
These software products contain an open redirect vulnerability (CWE-601).
 

Impact

The user may be redirected to an arbitrary website when logging in to the product via a crafted URL or accessing a specially crafted URL while logged in to the product.

Solution

Apply the Patch
Apply the patch according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
Fuji Xerox Co.,Ltd. Vulnerable 2019/08/20 Fuji Xerox Co.,Ltd. website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Base Score: 4.7
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score: 4.3
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Credit

KOBAYASHI Haruki of Cryptography Laboratory, Department of Information and Communication Engineering, Graduate School of Tokyo Denki University and NAKAMURA Dai of Cryptography Laboratory, Department of Information and Communication Engineering, Tokyo Denki University reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2019-6004
JVN iPedia JVNDB-2019-000052

Update History

2019/08/20
Fuji Xerox Co.,Ltd. update status