CVE-2018-0686 - OpenCVE

Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote authenticated attackers to upload and execute any executable files via unspecified vectors.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Neo	Debun Imap Debun Pop

Configuration 1 [-]

OR	cpe:2.3:a:neo:debun_imap::::::::
	cpe:2.3:a:neo:debun_pop::::::::

No data.

References

Link	Providers
http://jvn.jp/en/jp/JVN00344155/index.html
https://www.denbun.com/en/imap/support/security/181003.html
https://www.denbun.com/en/pop/support/security/181003.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2018-11-15T15:00:00

Updated: 2024-08-05T03:35:49.075Z

Reserved: 2017-11-27T00:00:00

Link: CVE-2018-0686

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2018-11-15T15:29:00.723

Modified: 2018-12-17T15:14:37.583

Link: CVE-2018-0686

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)", "vendor": "NEOJAPAN Inc.", "versions": [{"status": "affected", "version": "Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier"}]}], "datePublic": "2018-11-15T00:00:00", "descriptions": [{"lang": "en", "value": "Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote authenticated attackers to upload and execute any executable files via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-11-15T14:57:01", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.denbun.com/en/pop/support/security/181003.html"}, {"name": "JVN#00344155", "tags": ["third-party-advisory", "x_refsource_JVN"], "url": "http://jvn.jp/en/jp/JVN00344155/index.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.denbun.com/en/imap/support/security/181003.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2018-0686", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)", "version": {"version_data": [{"version_value": "Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier"}]}}]}, "vendor_name": "NEOJAPAN Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote authenticated attackers to upload and execute any executable files via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Unrestricted Upload of File with Dangerous Type"}]}]}, "references": {"reference_data": [{"name": "https://www.denbun.com/en/pop/support/security/181003.html", "refsource": "MISC", "url": "https://www.denbun.com/en/pop/support/security/181003.html"}, {"name": "JVN#00344155", "refsource": "JVN", "url": "http://jvn.jp/en/jp/JVN00344155/index.html"}, {"name": "https://www.denbun.com/en/imap/support/security/181003.html", "refsource": "MISC", "url": "https://www.denbun.com/en/imap/support/security/181003.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:35:49.075Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.denbun.com/en/pop/support/security/181003.html"}, {"name": "JVN#00344155", "tags": ["third-party-advisory", "x_refsource_JVN", "x_transferred"], "url": "http://jvn.jp/en/jp/JVN00344155/index.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.denbun.com/en/imap/support/security/181003.html"}]}]}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2018-0686", "datePublished": "2018-11-15T15:00:00", "dateReserved": "2017-11-27T00:00:00", "dateUpdated": "2024-08-05T03:35:49.075Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:neo:debun_imap:*:*:*:*:*:*:*:*", "matchCriteriaId": "11D627EC-0433-4F89-818A-AC39E2E10237", "versionEndIncluding": "3.3i_r4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:neo:debun_pop:*:*:*:*:*:*:*:*", "matchCriteriaId": "AEC73120-D8A0-4B96-A781-2843D07DB374", "versionEndIncluding": "3.3p_r4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote authenticated attackers to upload and execute any executable files via unspecified vectors."}, {"lang": "es", "value": "Denbun, de NEOJAPAN Inc. (Denbun POP en versiones V3.3P R4.0 y anteriores, Denbun IMAP en versiones V3.3I R4.0 y anteriores) permite que los atacantes remotos autenticados suban y ejecuten cualquier archivo ejecutable mediante vectores sin especificar."}], "id": "CVE-2018-0686", "lastModified": "2018-12-17T15:14:37.583", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-11-15T15:29:00.723", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "http://jvn.jp/en/jp/JVN00344155/index.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.denbun.com/en/imap/support/security/181003.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.denbun.com/en/pop/support/security/181003.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}