jvndb - jvndb-2020-000087

jvndb-2020-000087

Vulnerability from jvndb

Published

2020-12-18 17:00

Modified

2021-07-21 16:21

Severity ?

4.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

Management software for NEC Storage disk array system vulnerable to improper server certificate verification

Details

Management software for NEC Storage disk array system provided by NEC Corporation is vulnerable to improper server certificate verification (CWE-295). Masaaki KOBAYASHI reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN10100024/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5684
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2020-5684
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	NEC Corporation	iSM Client

Show details on JVN DB website

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000087.html",
  "dc:date": "2021-07-21T16:21+09:00",
  "dcterms:issued": "2020-12-18T17:00+09:00",
  "dcterms:modified": "2021-07-21T16:21+09:00",
  "description": "Management software for NEC Storage disk array system provided by NEC Corporation is vulnerable to improper server certificate verification (CWE-295).\r\n\r\nMasaaki KOBAYASHI reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000087.html",
  "sec:cpe": {
    "#text": "cpe:/a:nec:ism_client",
    "@product": "iSM Client",
    "@vendor": "NEC Corporation",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2020-000087",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN10100024/index.html",
      "@id": "JVN#10100024",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5684",
      "@id": "CVE-2020-5684",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5684",
      "@id": "CVE-2020-5684",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Management software for NEC Storage disk array system vulnerable to improper server certificate verification"
}

cve-2020-5684

Vulnerability from cvelistv5

Published

2020-12-24 01:20

Modified

2024-08-04 08:39

Severity ?

Summary

iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate.

References

▼	URL	Tags
	https://jpn.nec.com/security-info/secinfo/nv20-015.html	x_refsource_MISC
	https://jvn.jp/en/jp/JVN10100024/index.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	NEC Corporation	Management software for NEC Storage disk array system

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:39:25.823Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jpn.nec.com/security-info/secinfo/nv20-015.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN10100024/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Management software for NEC Storage disk array system",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper server certificate verification",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-24T01:20:20",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jpn.nec.com/security-info/secinfo/nv20-015.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN10100024/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5684",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Management software for NEC Storage disk array system",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NEC Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper server certificate verification"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jpn.nec.com/security-info/secinfo/nv20-015.html",
              "refsource": "MISC",
              "url": "https://jpn.nec.com/security-info/secinfo/nv20-015.html"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN10100024/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN10100024/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5684",
    "datePublished": "2020-12-24T01:20:20",
    "dateReserved": "2020-01-06T00:00:00",
    "dateUpdated": "2024-08-04T08:39:25.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.