« Volver al listado

CVE-2019-5919

Estado: ModificadaCrítica (9.1)—

An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nablarch Project — Nablarch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-5919",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "TIS Inc.",
          "product": "Nablarch 5",
          "versions": [
            {
              "status": "affected",
              "version": "Nablarch 5, and 5u1 to 5u13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-12T22:29:00.910",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN56542712/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://nablarch.atlassian.net/browse/NAB-313",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN56542712/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nablarch.atlassian.net/browse/NAB-313",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Una criptografía incompleta de la función \"data store\" al utilizar la etiqueta \"hidden\" en NaBlarch 5 (5 y desde la versión 5u1 hasta la 5u13) permite a los atacantes remotos obtener información sobre los datos almacenados para registrar una entrada no válida o alterar el valor mediante vectores sin especificar."
    }
  ],
  "lastModified": "2026-06-17T02:38:25.047",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nablarch_project:nablarch:5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B05E580A-3F3C-45BC-B8D0-AB89E8B7DDA8"
            },
            {
              "criteria": "cpe:2.3:a:nablarch_project:nablarch:5u1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC8E2C1D-6523-4B2F-B936-E3E97A7C24FC"
            },
            {
              "criteria": "cpe:2.3:a:nablarch_project:nablarch:5u13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4569B57-F7DD-40FC-AB44-0810895E921E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}