Vulnerability in Japan Agency For Local Authority Information Systems Installer The Public Certification Service Individuals "The Jpki User's Software"
CVE-2017-2157
Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)", The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier that were available until April 27, 2017 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
EPSS: 0.005 (40.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Japan Agency For Local Authority Information Systems Installer The Public Certification Service Individuals "The Jpki User's Software" — versions Ver2.6 and earlier that was available until April 27, 2017
- Japan Agency For Local Authority Information Systems Installer The Public Certification Service Individuals "The Jpki User's Software (For Windows 7 And Later)" — versions Ver3.1 and earlier that was available until April 27, 2017
- Japan Agency For Local Authority Information Systems Installer The Public Certification Service Individuals "The Jpki User's Software (For Windows Vista)" — versions available until April 27, 2017
- Jpki The_public_certification_service_for_individuals
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (Patch, x_refsource_MISC, Vendor Advisory)
- vultures@jpcert.or.jp (VDB Entry, Third Party Advisory, x_refsource_JVN, third-party-advisory)
Frequently asked questions
- What is CVE-2017-2157?
- CVE-2017-2157 is a high-severity vulnerability in Japan Agency For Local Authority Information Systems Installer The Public Certification Service Individuals "The Jpki User's Software", classified under Untrusted Search Path. CVSS score: 7.3/10. Published 2017-05-12.
- How severe is CVE-2017-2157?
- High severity. CVSS v3 base score is 7.3 out of 10.