PT-2017-8541 · Money Forward · Money Forward For Shiga Bank+9

Akinori Konishi + 2 · Published 2017-05-12 · Updated 2021-05-12 · CVE-2016-4838

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Money Forward versions prior to 7.18.0 Money Forward for The Gunma Bank versions prior to 1.2.0 Money Forward for SHIGA BANK versions prior to 1.2.0 Money Forward for SHIZUOKA BANK versions prior to 1.4.0 Money Forward for SBI Sumishin Net Bank versions prior to 1.6.0 Money Forward for Tokai Tokyo Securities versions prior to 1.4.0 Money Forward for THE TOHO BANK versions prior to 1.3.0 Money Forward for YMFG versions prior to 1.5.0 Money Forward for AppPass versions prior to 7.18.3 Money Forward for au SMARTPASS versions prior to 7.18.0 Money Forward for Chou Houdai versions prior to 7.18.3

Description The issue allows an attacker to execute unintended operations via a specially crafted application.

Recommendations For Money Forward versions prior to 7.18.0, update to version 7.18.0 or later. For Money Forward for The Gunma Bank versions prior to 1.2.0, update to version 1.2.0 or later. For Money Forward for SHIGA BANK versions prior to 1.2.0, update to version 1.2.0 or later. For Money Forward for SHIZUOKA BANK versions prior to 1.4.0, update to version 1.4.0 or later. For Money Forward for SBI Sumishin Net Bank versions prior to 1.6.0, update to version 1.6.0 or later. For Money Forward for Tokai Tokyo Securities versions prior to 1.4.0, update to version 1.4.0 or later. For Money Forward for THE TOHO BANK versions prior to 1.3.0, update to version 1.3.0 or later. For Money Forward for YMFG versions prior to 1.5.0, update to version 1.5.0 or later. For Money Forward for AppPass versions prior to 7.18.3, update to version 7.18.3 or later. For Money Forward for au SMARTPASS versions prior to 7.18.0, update to version 7.18.0 or later. For Money Forward for Chou Houdai versions prior to 7.18.3, update to version 7.18.3 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-4838

Affected Products

Money Forward

Money Forward For Apppass

Money Forward For Chou Houdai

Money Forward For Sbi Sumishin Net Bank

Money Forward For Shiga Bank

Money Forward For The Toho Bank

Money Forward For The Gunma Bank

Money Forward For Tokai Tokyo Securities

Money Forward For Ymfg

Money Forward For Au Smartpass

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2016-4838 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4838 · Vendor Advisory
• https://jvn.jp/en/jp/JVN49343562/index.html · Note
• http://securityfocus.com/bid/93034 · Note
• http://sourcenext.com/support/i/160725_1 · Note
• https://t.me/cvenotify/14303 · Telegram Post
• http://corp.moneyforward.com/info/20160920-mf-android · Note