Vulnerability in Japan Agency For Local Authority Information Systems Installer The Public Certification Service Individuals "The Jpki User's Software"
CVE-2017-2157
Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)", The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier that were available until April 27, 2017 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (40.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 40.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Japan Agency For Local Authority Information Systems Installer The Public Certification Service Individuals "The Jpki User's Software" — versions Ver2.6 and earlier that was available until April 27, 2017
- Japan Agency For Local Authority Information Systems Installer The Public Certification Service Individuals "The Jpki User's Software (For Windows 7 And Later)" — versions Ver3.1 and earlier that was available until April 27, 2017
- Japan Agency For Local Authority Information Systems Installer The Public Certification Service Individuals "The Jpki User's Software (For Windows Vista)" — versions available until April 27, 2017
- Jpki The Public Certification Service For Individuals
Weakness classification (CWE)
References
- www.jpki.go.jp/download/win.html (Patch, Vendor Advisory)
- jvn.jp/en/jp/JVN39605485/index.html (VDB Entry, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2017-2157?
- CVE-2017-2157 is a high-severity vulnerability in Japan Agency For Local Authority Information Systems Installer The Public Certification Service Individuals "The Jpki User's Software", classified under Untrusted Search Path. CVSS score: 7.3/10. Published 2017-05-12.
- How severe is CVE-2017-2157?
- High severity. CVSS v3 base score is 7.3 out of 10.