What is GHSA-hmx6-gc2p-5p82?

GHSA-hmx6-gc2p-5p82 is a security advisory published by GitHub Security Advisories with Critical severity. Nablarch Incomplete Cryptography

Which CVE IDs does GHSA-hmx6-gc2p-5p82 cover?

GHSA-hmx6-gc2p-5p82 covers the following CVE IDs: CVE-2019-5919. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hmx6-gc2p-5p82?

GHSA-hmx6-gc2p-5p82 has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-hmx6-gc2p-5p82?

GHSA-hmx6-gc2p-5p82 affects 1 product, including: maven/com.nablarch.framework:nablarch-fw-web:\u003c 1.5.1.

GHSA-hmx6-gc2p-5p82CriticalCVSS 9.1

Nablarch Incomplete Cryptography

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

August 3, 2023

🔗 CVE IDs covered (1)

CVE-2019-5919 →

📋 Description

An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors.

🎯 Affected products1

maven/com.nablarch.framework:nablarch-fw-web:< 1.5.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-5919
https://nablarch.atlassian.net/browse/NAB-313
http://jvn.jp/en/jp/JVN56542712/index.html
https://github.com/nablarch/nablarch-fw-web/pull/53
https://github.com/nablarch/nablarch-fw-web/pull/54
https://github.com/advisories/GHSA-hmx6-gc2p-5p82