PT-2017-8541 · Money Forward · Money Forward For Shiga Bank+9

Akinori Konishi + 2 · Publicado 2017-05-12 · Atualizado 2021-05-12 · CVE-2016-4838

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Money Forward versions prior to 7.18.0 Money Forward for The Gunma Bank versions prior to 1.2.0 Money Forward for SHIGA BANK versions prior to 1.2.0 Money Forward for SHIZUOKA BANK versions prior to 1.4.0 Money Forward for SBI Sumishin Net Bank versions prior to 1.6.0 Money Forward for Tokai Tokyo Securities versions prior to 1.4.0 Money Forward for THE TOHO BANK versions prior to 1.3.0 Money Forward for YMFG versions prior to 1.5.0 Money Forward for AppPass versions prior to 7.18.3 Money Forward for au SMARTPASS versions prior to 7.18.0 Money Forward for Chou Houdai versions prior to 7.18.3

Description The issue allows an attacker to execute unintended operations via a specially crafted application.

Recommendations For Money Forward versions prior to 7.18.0, update to version 7.18.0 or later. For Money Forward for The Gunma Bank versions prior to 1.2.0, update to version 1.2.0 or later. For Money Forward for SHIGA BANK versions prior to 1.2.0, update to version 1.2.0 or later. For Money Forward for SHIZUOKA BANK versions prior to 1.4.0, update to version 1.4.0 or later. For Money Forward for SBI Sumishin Net Bank versions prior to 1.6.0, update to version 1.6.0 or later. For Money Forward for Tokai Tokyo Securities versions prior to 1.4.0, update to version 1.4.0 or later. For Money Forward for THE TOHO BANK versions prior to 1.3.0, update to version 1.3.0 or later. For Money Forward for YMFG versions prior to 1.5.0, update to version 1.5.0 or later. For Money Forward for AppPass versions prior to 7.18.3, update to version 7.18.3 or later. For Money Forward for au SMARTPASS versions prior to 7.18.0, update to version 7.18.0 or later. For Money Forward for Chou Houdai versions prior to 7.18.3, update to version 7.18.3 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-4838

Produtos afetados

Money Forward

Money Forward For Apppass

Money Forward For Chou Houdai

Money Forward For Sbi Sumishin Net Bank

Money Forward For Shiga Bank

Money Forward For The Toho Bank

Money Forward For The Gunma Bank

Money Forward For Tokai Tokyo Securities

Money Forward For Ymfg

Money Forward For Au Smartpass

Referências · 7

• https://jvn.jp/en/jp/JVN49343562/index.html · Nota
• http://securityfocus.com/bid/93034 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4838 · Nota de Segurança
• http://sourcenext.com/support/i/160725_1 · Nota
• https://t.me/cvenotify/14303 · Publicação no Telegram
• http://corp.moneyforward.com/info/20160920-mf-android · Nota
• https://osv.dev/vulnerability/CVE-2016-4838 · Aviso do Fabricante