CVE-2016-7843

Directory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4.6 and earlier, and AttacheCase Pro 1.5.7 and earlier allows remote attackers to read arbitrary files via specially crafted ATC file.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://jvn.jp/en/jp/JVN28331227/index.html	Third Party Advisory VDB Entry
http://maruuofactory.life.coocan.jp/attachecase/#pathTraversal	Third Party Advisory
http://www.securityfocus.com/bid/95445	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hibara_software:attachecase_for_java::::::::
	cpe:2.3:a:hibara_software:attachecase_lite::::::::
	cpe:2.3:a:hibara_software:attachecase_pro::::::::

History

No history.

Information

Published : 2017-04-28 16:59

Updated : 2017-05-10 19:15

NVD link : CVE-2016-7843

Mitre link : CVE-2016-7843

CVE.ORG link : CVE-2016-7843

JSON object : View

Products Affected

hibara_software

attachecase_for_java
attachecase_lite
attachecase_pro

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2016-7843", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2017-04-28T16:59:00.340", "references": [{"url": "http://jvn.jp/en/jp/JVN28331227/index.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "http://maruuofactory.life.coocan.jp/attachecase/#pathTraversal", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "http://www.securityfocus.com/bid/95445", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4.6 and earlier, and AttacheCase Pro 1.5.7 and earlier allows remote attackers to read arbitrary files via specially crafted ATC file."}, {"lang": "es", "value": "Vulnerabilidad de acceso a directorios en AttacheCase para Java 0.60 y anteriores, AttacheCase Lite 1.4.6 y versiones anteriores y AttacheCase Pro 1.5.7 y versiones anteriores permiten a atacantes remotos leer archivos arbitrarios a trav\u00e9s de un archivo ATC especialmente dise\u00f1ado."}], "lastModified": "2017-05-10T19:15:45.417", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hibara_software:attachecase_for_java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0F53FAA-2F3D-4BFB-9AD1-7FFAF89CCCFB", "versionEndIncluding": "0.6.0"}, {"criteria": "cpe:2.3:a:hibara_software:attachecase_lite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A339A10E-9444-48CB-AE4E-4FCD670E6840", "versionEndIncluding": "1.4.6"}, {"criteria": "cpe:2.3:a:hibara_software:attachecase_pro:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A978775-089D-40E0-B122-0EED6049AFCA", "versionEndIncluding": "1.5.7"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}