Description
An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TIS | Nablarch 5 | Nablarch 5, and 5u1 to 5u13 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.nablarch.framework:nablarch-fw-web | < 1.5.1 | 1.5.1 | GHSA-hmx6-gc2p-5p82 |
References
- https://nablarch.atlassian.net/browse/NAB-313
- JVN#56542712 third-party-advisory