JVN#83428818 La!cooda WIZ and LacoodaST vulnerable to cross-site request forgery

Overview

La!cooda WIZ and LacoodaST contain a cross-site request forgery vulnerability.

Products Affected

La!cooda WIZ 1.4.0 and earlier
LacoodaST 2.1.3 and earlier

For more information, refer to the vendors' websites.

Description

La!cooda WIZ from System Consultants Co., Ltd. and LacoodaST from SpaceTag, Inc. are groupware providing schedule and task managements, etc. La!cooda WIZ and LacoodaST contain a cross-site request forgery vulnerability.

Impact

Password or other configurations may be changed if the logged in user views a malicious web page.

Solution

Update the Software
Apply the latest updates provided by the vendors.
For more information, refer to the vendors' websites.

Vendor Status

Vendor	Link
System Consultants Co., Ltd.	About multiple vulnerabilities in La!cooda WIZ
SpaceTag, Inc.	About multiple vulnerabilities in LacoodaST

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2008.08.21

Measures	Conditions	Severity
Access Required	Routed - can be attacked over the Internet using packets	High
Authentication	None - anonymous or no authentication (IP addresses do not count)	High
User Interaction Required	Simple - the user must be convinced to take a standard action that does not feel harmful to most users, such as click on a link or view a file	Medium
Exploit Complexity	Low - little to no expertise and/or luck required to exploit (cross-site scripting)	High

Description of each analysis measures

Credit

Hirotaka Katagiri reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE	CVE-2008-3736
JVN iPedia	JVNDB-2008-000046