jvndb - jvndb-2007-001091

jvndb-2007-001091

Vulnerability from jvndb

Published

2008-05-21 00:00

Modified

2008-05-21 00:00

Severity ?

() - -

Summary

Cosminexus Application Server Incorrect Group Permission Handling Vulnerability

Details

When a logical J2EE server or logical user server is started from Cosminexus Manager in Cosminexus Application Server, Cosminexus Manager may assign the wrong user's group permissions to an activated server process.

References

▼	Type	URL
	CVE	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4564
	NVD	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4564
	SECUNIA	http://secunia.com/advisories/26589
	BID	http://www.securityfocus.com/bid/25434
	XF	http://xforce.iss.net/xforce/xfdb/36245
	Permissions(CWE-264)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	Hitachi, Ltd	Cosminexus Application Server
	Hitachi, Ltd	Electronic Form Workflow
	Hitachi, Ltd	uCosminexus Application Server
	Hitachi, Ltd	uCosminexus Service

Show details on JVN DB website

JSON

To clipboard

{
   "@rdf:about": "https://jvndb.jvn.jp/en/contents/2007/JVNDB-2007-001091.html",
   "dc:date": "2008-05-21T00:00+09:00",
   "dcterms:issued": "2008-05-21T00:00+09:00",
   "dcterms:modified": "2008-05-21T00:00+09:00",
   description: "When a logical J2EE server or logical user server is started from Cosminexus Manager in Cosminexus Application Server, Cosminexus Manager may assign the wrong user's group permissions to an activated server process.",
   link: "https://jvndb.jvn.jp/en/contents/2007/JVNDB-2007-001091.html",
   "sec:cpe": [
      {
         "#text": "cpe:/a:hitachi:cosminexus_application_server",
         "@product": "Cosminexus Application Server",
         "@vendor": "Hitachi, Ltd",
         "@version": "2.2",
      },
      {
         "#text": "cpe:/a:hitachi:electronic_form_workflow",
         "@product": "Electronic Form Workflow",
         "@vendor": "Hitachi, Ltd",
         "@version": "2.2",
      },
      {
         "#text": "cpe:/a:hitachi:ucosminexus_application_server",
         "@product": "uCosminexus Application Server",
         "@vendor": "Hitachi, Ltd",
         "@version": "2.2",
      },
      {
         "#text": "cpe:/a:hitachi:ucosminexus_service",
         "@product": "uCosminexus Service",
         "@vendor": "Hitachi, Ltd",
         "@version": "2.2",
      },
   ],
   "sec:cvss": {
      "@score": "4.6",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
      "@version": "2.0",
   },
   "sec:identifier": "JVNDB-2007-001091",
   "sec:references": [
      {
         "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4564",
         "@id": "CVE-2007-4564",
         "@source": "CVE",
      },
      {
         "#text": "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4564",
         "@id": "CVE-2007-4564",
         "@source": "NVD",
      },
      {
         "#text": "http://secunia.com/advisories/26589",
         "@id": "SA26589",
         "@source": "SECUNIA",
      },
      {
         "#text": "http://www.securityfocus.com/bid/25434",
         "@id": "25434",
         "@source": "BID",
      },
      {
         "#text": "http://xforce.iss.net/xforce/xfdb/36245",
         "@id": "36245",
         "@source": "XF",
      },
      {
         "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
         "@id": "CWE-264",
         "@title": "Permissions(CWE-264)",
      },
   ],
   title: "Cosminexus Application Server Incorrect Group Permission Handling Vulnerability",
}

cve-2007-4564

Vulnerability from cvelistv5

Published

2007-08-28 01:00

Modified

2024-08-07 15:01

Severity ?

Summary

Cosminexus Manager in Cosminexus Application Server 07-00 and later might assign the wrong user's group permissions to logical user server processes, which allows local users to gain privileges.

References

▼	URL	Tags
	http://www.hitachi-support.com/security_e/vuls_e/HS07-025_e/index-e.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/25434	vdb-entry, x_refsource_BID
	http://osvdb.org/37855	vdb-entry, x_refsource_OSVDB
	http://secunia.com/advisories/26589	third-party-advisory, x_refsource_SECUNIA
	https://exchange.xforce.ibmcloud.com/vulnerabilities/36245	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-07T15:01:09.517Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.hitachi-support.com/security_e/vuls_e/HS07-025_e/index-e.html",
               },
               {
                  name: "25434",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/25434",
               },
               {
                  name: "37855",
                  tags: [
                     "vdb-entry",
                     "x_refsource_OSVDB",
                     "x_transferred",
                  ],
                  url: "http://osvdb.org/37855",
               },
               {
                  name: "26589",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/26589",
               },
               {
                  name: "cosminexus-group-security-bypass(36245)",
                  tags: [
                     "vdb-entry",
                     "x_refsource_XF",
                     "x_transferred",
                  ],
                  url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/36245",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2007-08-24T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cosminexus Manager in Cosminexus Application Server 07-00 and later might assign the wrong user's group permissions to logical user server processes, which allows local users to gain privileges.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-07-28T12:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.hitachi-support.com/security_e/vuls_e/HS07-025_e/index-e.html",
            },
            {
               name: "25434",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/25434",
            },
            {
               name: "37855",
               tags: [
                  "vdb-entry",
                  "x_refsource_OSVDB",
               ],
               url: "http://osvdb.org/37855",
            },
            {
               name: "26589",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/26589",
            },
            {
               name: "cosminexus-group-security-bypass(36245)",
               tags: [
                  "vdb-entry",
                  "x_refsource_XF",
               ],
               url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/36245",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2007-4564",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cosminexus Manager in Cosminexus Application Server 07-00 and later might assign the wrong user's group permissions to logical user server processes, which allows local users to gain privileges.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "http://www.hitachi-support.com/security_e/vuls_e/HS07-025_e/index-e.html",
                     refsource: "CONFIRM",
                     url: "http://www.hitachi-support.com/security_e/vuls_e/HS07-025_e/index-e.html",
                  },
                  {
                     name: "25434",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/25434",
                  },
                  {
                     name: "37855",
                     refsource: "OSVDB",
                     url: "http://osvdb.org/37855",
                  },
                  {
                     name: "26589",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/26589",
                  },
                  {
                     name: "cosminexus-group-security-bypass(36245)",
                     refsource: "XF",
                     url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/36245",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2007-4564",
      datePublished: "2007-08-28T01:00:00",
      dateReserved: "2007-08-27T00:00:00",
      dateUpdated: "2024-08-07T15:01:09.517Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted