JVN#74538317
Multiple vulnerabilities in Exment

Overview

Exment provided by Kajitori Co.,Ltd contains multiple vulnerabilities.

Products Affected

• Exment v6.1.4 and earlier
• Exment v5.0.11 and earlier

Description

Exment provided by Kajitori Co.,Ltd contains multiple vulnerabilities listed below.

• Incorrect Permission Assignment for Critical Resource (CWE-732)
  • CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N Base Score 3.8
  • CVE-2024-46897
• Stored Cross-site Scripting (CWE-79)
  • CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score 5.4
  • CVE-2024-47793

Impact

• A logged-in user with the permission of table management may obtain and/or alter the information of the unauthorized tables (CVE-2024-46897)
• When accessing the edit screen containing custom columns (column type: images or files), an arbitrary script may be executed on the web browser of the user (CVE-2024-47793)

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.
The developer has released v6.1.5 and v5.0.12 that contain the fixes for these vulnerabilities.

Apply the workaround
The developer provides the workaround information to the users who cannot update the affected product to the latest version immediately.
Refer to the information provided by the developer.