GitHub Advisoryadvisory · Maven

GHSA-hmx6-gc2p-5p82 Nablarch Incomplete Cryptography

CRITICAL Published 2022-05-13 Modified 2023-07-19 Official page ↗
Aliases
CVE-2019-5919
Ecosystem
Maven
Packages
com.nablarch.framework:nablarch-fw-web
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-327
Reviewed
2023-07-19

Affected packages

• Maven com.nablarch.framework:nablarch-fw-web: < 1.5.1 → fixed in 1.5.1

Description

An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2019-5919 An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References