JVN#34205166
SYNCK GRAPHICA Mailform Pro CGI vulnerable to information disclosure
Overview
Mailform Pro CGI provided by SYNCK GRAPHICA contains an information disclosure vulnerability.
Products Affected
- Mailform Pro CGI 4.3.1 and earlier
Description
Mailform Pro CGI provided by SYNCK GRAPHICA contains an information disclosure vulnerability (CWE-200).
Thanks module of this product saves user input data for a certain period of time. The time is set to 30 seconds by default in configs/thanks.cgi file. To exploit this vulnerability, it is required for an attacker to access the affected product within 30 seconds.
Impact
By having a use of the product to access a specially crafted URL by an attacker, the user input data may be disclosed.
Solution
Update the Software
Update the software to the latest version according to the information provided by the developer.
Apply a workaround
The following workaround may mitigate the impact of this vulnerability.
- Disable thanks module
Vendor Status
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2022-38400 |
| JVN iPedia |
JVNDB-2022-000068 |
Update History
- 2022/09/05
- Fixed the descriptions under the section [Description] and [Impact].