« Volver al listado

CVE-2017-2154

Estado: ModificadaAlta (7.8)—

Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST Frontier 3, JUST School 6 Premium, Hanako Police 5, JUST Police 3, Hanako 2017 trial version allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (9)

Justsystems — HanakoJustsystems — Hanako PoliceJustsystems — Hanako PROJustsystems — Just FrontierJustsystems — Just GovernmentJustsystems — Just Jump ClassJustsystems — Just OfficeJustsystems — Just PoliceJustsystems — Just School

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-2154",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-04-28T16:59:02.090",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN54268888/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.justsystems.com/jp/info/js17002.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN54268888/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.justsystems.com/jp/info/js17002.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST Frontier 3, JUST School 6 Premium, Hanako Police 5, JUST Police 3, Hanako 2017 trial version allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de ruta (path) de búsqueda no confiable en Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Estándar], Just Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST Frontier 3, JUST School 6 Premium, Hanako Police 5, JUST Police 3, Hanako 2017 versión de prueba, permite a los atacantes remotos alcanzar privilegios por medio de un archivo DLL de tipo caballo de troya en un directorio no especificado."
    }
  ],
  "lastModified": "2026-06-17T01:15:39.187",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:justsystems:hanako:2015:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7048C6C-0CE8-4642-A5C4-2D27E8B9CEA3"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:hanako:2016:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB3FF218-7C81-44D2-9A17-D83205685973"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:hanako:2017:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "776ED90F-323C-4A61-888A-43A9C562C64A"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:hanako:2017:*:*:*:trial_version:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57895402-E3E8-49A2-8FA6-8A1D15E8E1C0"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:hanako_police:5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D59D8562-98D0-41B2-B558-596C89C9D522"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:hanako_pro:3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16485AD9-56B0-4BFB-993C-7B94F325412D"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:just_frontier:3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A99D14B3-56D2-470A-A9B3-B7503EBDC0F6"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:just_government:3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B20409BA-5D02-423B-B9D4-B912D9148E72"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:just_jump_class:2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3FE275B-F4CD-48E1-9063-A70BBD02327F"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:just_office:3:*:*:*:eco_print_pack:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0CF5451A-6B63-4057-BCC4-9AB43ED32384"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:just_office:3:*:*:*:standard:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCE3335A-F74F-46AC-8376-3E5E2D4A90FB"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:just_office:3:*:*:*:tri-de_dataprotect_pack:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0B3FDCA-63D0-47BA-8B99-6565857123E5"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:just_police:3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9F17734-FC13-4E08-B350-C6C0CDCD17D0"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:just_school:6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1874BEA7-E29B-42AD-B111-9EBAEBCAB39C"
            },
            {
              "criteria": "cpe:2.3:a:justsystems:just_school:6:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7434D5C9-DC0B-4E76-A9DC-D8AA1F50A4F2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}