« Volver al listado

CVE-2023-51436

Estado: AplazadaMedia (5.9)—

Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote authenticated attacker with an administrative privilege to execute an arbitrary script on the web browser of the user who is using the product.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Universal Passport — Universal Passport RXAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-51436",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-51436",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-04T19:44:04.953743Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Japan System Techniques Co., Ltd.",
          "product": "UNIVERSAL PASSPORT RX",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0 to 1.0.8"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:japan_system_techniques:universal_passport_rx:*:*:*:*:*:*:*:*"
          ],
          "vendor": "japan_system_techniques",
          "product": "universal_passport_rx",
          "versions": [
            {
              "status": "unknown",
              "version": "1.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "1.0.8"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-03T04:15:09.287",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN43215077/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.jast-gakuen.com/products/unipa/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN43215077/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.jast-gakuen.com/products/unipa/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote authenticated attacker with an administrative privilege to execute an arbitrary script on the web browser of the user who is using the product. "
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de cross-site scripting en las versiones 1.0.0 a 1.0.8 de UNIVERSAL PASSPORT RX, que puede permitir que un atacante remoto autenticado con privilegios administrativos ejecute un script  arbitrario en el navegador web del usuario que está utilizando el producto."
    }
  ],
  "lastModified": "2026-06-17T06:40:57.217",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}