CVE-2015-0898 : futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl co

futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors.

Published 2015-03-21 01:59:03

Updated 2015-03-27 07:35:39

Source JPCERT/CC

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2015-0898

Probability of exploitation activity in the next 30 days: 0.65%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 77 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2015-0898

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2015-0898

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-0898

http://jvn.jp/en/jp/JVN39175666/index.html

JVN#39175666: MP Form Mail CGI eCommerce edition vulnerable to code injection
Patch;Vendor Advisory
http://jvn.jp/en/jp/JVN39175666/221504/index.html

Japan Vulnerability Notes/Information from futomi Co., Ltd.
Vendor Advisory
http://www.futomi.com/library/info/2015/20150319.html

MP Form Mail CGI eCommerce 版をWindowsサーバーでご利用の方へバージョンアップのお願い - futomi's CGI Cafe
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000041

JVNDB-2015-000041 - JVN iPedia - 脆弱性対策情報データベース
Vendor Advisory

Products affected by CVE-2015-0898

Futomi » Mp Form Mail Cgi » Ecommerce Edition
Versions up to, including, (<=) 2.0.11
cpe:2.3:a:futomi:mp_form_mail_cgi:*:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.1 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.1:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.4 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.4:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.6 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.6:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.10 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.10:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.12 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.12:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.2 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.2:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.3 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.3:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.8 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.8:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.9 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.9:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.0 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.0:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.5 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.5:*:*:*:ecommerce:*:*:*
Matching versions
Futomi » Mp Form Mail Cgi » Version: 2.0.7 Ecommerce Edition
cpe:2.3:a:futomi:mp_form_mail_cgi:2.0.7:*:*:*:ecommerce:*:*:*
Matching versions

Vulnerability Details : CVE-2015-0898

Exploit prediction scoring system (EPSS) score for CVE-2015-0898

CVSS scores for CVE-2015-0898

CWE ids for CVE-2015-0898

References for CVE-2015-0898

Products affected by CVE-2015-0898