« Volver al listado

CVE-2023-42427

Estado: AplazadaMedia (6.5)—

Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Universal Passport RX — Universal Passport RXAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-42427",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-42427",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-03T18:06:11.605847Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Japan System Techniques Co., Ltd.",
          "product": "UNIVERSAL PASSPORT RX",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0 to 1.0.7"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:japan_system_techniques:universal_passport_rx:*:*:*:*:*:*:*:*"
          ],
          "vendor": "japan_system_techniques",
          "product": "universal_passport_rx",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "1.0.7"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-03T04:15:08.830",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN43215077/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.jast-gakuen.com/products/unipa/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN43215077/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.jast-gakuen.com/products/unipa/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is using the product."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de cross-site scripting en UNIVERSAL PASSPORT RX versiones 1.0.0 a 1.0.7, que puede permitir que un atacante remoto autenticado ejecute un script arbitrario en el navegador web del usuario que está utilizando el producto."
    }
  ],
  "lastModified": "2026-06-17T06:23:48.930",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}