CVE-2024-7898

A vulnerability classified as critical was found in Tosei Online Store Management System ??????????? 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://gist.github.com/b0rgch3n/3136cad95b09e42184fb2d78aae33651	Broken Link
https://vuldb.com/?ctiid.274906	Permissions Required
https://vuldb.com/?id.274906	Permissions Required
https://vuldb.com/?submit.386560	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tosei-corporation:online_store_management_system:4.0.2:::::::*
	cpe:2.3:a:tosei-corporation:online_store_management_system:4.0.3:::::::*
	cpe:2.3:a:tosei-corporation:online_store_management_system:4.0.4:::::::*

History

27 Sep 2024, 00:34

Type	Values Removed	Values Added
First Time		Tosei-corporation Tosei-corporation online Store Management System
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:a:tosei-corporation:online_store_management_system:4.0.4:::::::* cpe:2.3:a:tosei-corporation:online_store_management_system:4.0.3:::::::* cpe:2.3:a:tosei-corporation:online_store_management_system:4.0.2:::::::*
CVSS	v2 : ~~7.5~~ v3 : ~~7.3~~	v2 : 7.5 v3 : 9.8
Summary	(en) A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	(en) A vulnerability classified as critical was found in Tosei Online Store Management System ??????????? 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References	~~() https://gist.github.com/b0rgch3n/3136cad95b09e42184fb2d78aae33651 -~~	() https://gist.github.com/b0rgch3n/3136cad95b09e42184fb2d78aae33651 - Broken Link
References	~~() https://vuldb.com/?ctiid.274906 -~~	() https://vuldb.com/?ctiid.274906 - Permissions Required
References	~~() https://vuldb.com/?id.274906 -~~	() https://vuldb.com/?id.274906 - Permissions Required
References	~~() https://vuldb.com/?submit.386560 -~~	() https://vuldb.com/?submit.386560 - Third Party Advisory

19 Aug 2024, 15:15

Type	Values Removed	Values Added
Summary	(en) A vulnerability classified as critical was found in Tosei Online Store Management System ??????????? 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	(en) A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

19 Aug 2024, 12:59

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad fue encontrada en Tosei Online Store Management System 4.02/4.03/4.04 y clasificada como crítica. Esta vulnerabilidad afecta a código desconocido del componente Backend. La manipulación conduce al uso de credenciales predeterminadas. El ataque se puede iniciar de forma remota. El exploit ha sido divulgado al público y puede utilizarse. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.
Summary	(en) A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	(en) A vulnerability classified as critical was found in Tosei Online Store Management System ??????????? 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

17 Aug 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-17 18:15

Updated : 2024-09-27 00:34

NVD link : CVE-2024-7898

Mitre link : CVE-2024-7898

CVE.ORG link : CVE-2024-7898

JSON object : View

Products Affected

tosei-corporation

online_store_management_system

CWE

NVD-CWE-noinfo CWE-1392

9.8 /10