{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000005.html",
  "dc:date": "2025-01-27T14:25+09:00",
  "dcterms:issued": "2025-01-27T14:25+09:00",
  "dcterms:modified": "2025-01-27T14:25+09:00",
  "description": "EXIF Viewer Classic provided by Rodrigue (former Kakera) is a Google Chrome browser extension.\r\nThe affected versions of the product improperly handle EXIF meta data, resulting in a cross-site scripting vulnerability (CWE-79).\r\n\r\nVersions 2.3.2 and 2.4.0 were reported as vulnerable. The vendor informs us that the product has been refactored after those old versions and that the current version 3.0.1 is not vulnerable.\r\n\r\nYuji Tounai of Mitsui Bussan Secure Directions, Inc. and Kouhei Morita reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000005.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:rodrigue_exif_viewer_classic",
    "@product": "EXIF Viewer Classic",
    "@vendor": "Rodrigue",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.1",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000005",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN05508012/index.html",
      "@id": "JVN#05508012",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-23362",
      "@id": "CVE-2025-23362",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EXIF Viewer Classic vulnerable to cross-site scripting"
}