ESB-2017.3155 - [Win] JP1/Service Support and JP1/Integrated Management: Cross-site scripting - Remote with user interaction 2017-12-08

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.3155
  Site TopVulnerability InformationCross-site Scripting Vulnerability in
    JP1/Service Support and JP1/Integrated Management - Service Support
                              8 December 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           JP1/Service Support and JP1/Integrated Management
Publisher:         Hitachi
Operating System:  Windows
Impact/Access:     Cross-site Scripting -- Remote with User Interaction
Resolution:        Patch/Upgrade

Original Bulletin: 
   http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-133/index.html

- --------------------------BEGIN INCLUDED TEXT--------------------

Site TopVulnerability InformationCross-site Scripting Vulnerability in 
JP1/Service Support and JP1/Integrated Management - Service Support

Cross-site Scripting Vulnerability in JP1/Service Support and JP1/Integrated 
Management - Service Support

Security Information IDVulnerability descriptionAffected productsFixed 
productsRevision history

Update: December 8, 2017

A cross-site scripting vulnerability was found in JP1/Service Support and 
JP1/Integrated Management - Service Support.

Security Information ID

hitachi-sec-2017-133

Vulnerability description

A cross-site scripting vulnerability was found in JP1/Service Support and 
JP1/Integrated Management - Service Support.

Remote users can exploit this vulnerability to execute malicious scripts.

Affected products and versions are listed below. Please upgrade your version 
to the appropriate version.

Affected products

The information is organized under the following headings:

(Example)

Product name: Gives the name of the affected product.

Version:

Platform

Gives the affected version.

Product name: JP1/Service Support

Product name: JP1/Service Support Starter Edition

Version(s):

Windows

11-00 to 11-10

Product name: JP1/Integrated Management - Service Support

Version(s):

Windows

09-50 to 10-50

Product name: Job Management Partner 1/Integrated Management - Service Support

Version(s):

Windows(Multi-language version)

10-10 to 10-50

Product name: JP1/Integrated Management - Service Support Starter Edition

Version(s):

Windows

10-10 to 10-50

Product name: JP1/Integrated Management - Service Support Advanced Edition

Version(s):

Windows

10-50

Product name: Job Management Partner 1/Integrated Management - Service Support
Advanced Edition

Version(s):

Windows(Multi-language version)

10-50

Fixed products

The information is organized under the following headings:

(Example)

Product name: Gives the name of the fixed product.

Version:

Platform

Gives the fixed version, and release date.

Scheduled version:

Platform

Gives the fixed version scheduled to be released.

Product name: JP1/Service Support

Product name: JP1/Service Support Starter Edition

Version(s):

Windows

11-50 November 30, 2017

11-10-01 December 6, 2017

Scheduled version(s):

Windows

11-00

Product name: JP1/Integrated Management - Service Support

Scheduled version(s):

Windows

10-50

Product name: JP1/Integrated Management - Service Support Starter Edition

Scheduled version(s):

Windows

10-50

Product name: JP1/Integrated Management - Service Support Advanced Edition

Scheduled version(s):

Windows

10-50

For details on the fixed products, contact your Hitachi support service 
representative.

Revision history

December 8, 2017

This page is released.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWionrIx+lLeg9Ub1AQjCNBAAqqf7qMDObMR1B/eseaclu2dmfK86rvvd
ZqQ07KBcQbMAhgxZLT9DPsjeJdC/1yyUlV6XXxMb9NedWBhzREalBz0BOC4dKbHx
caZ52de2cSKAM7PNF7RjDRb57kPuw6TUndSChn8r+SF/FHYLr3TZ/aLl8iTkYw1Y
UeNZyoSRMeV9aKkC2o+Mm2HZaGtJdQY/9PVAEhLRgI87odIYFEZT616n4vHQ4C8A
uCie2y22WszDHIW7tfe9HBY1K5ZzXmsqO+HJwczA3EImlG2O+Id4/L5/Df62as5a
4/f4ByttDMZAvn/lxU8whmkyTDMtUu0WkpN2bvvkM470mNRs4Z4+jlzPj5b+DVLN
BFrq4YAGHhBjrmXizk22RiwYGiYBtSWS0LwdycyWfyZOiRj3L8mlR7kkmPbOFY75
Wp+egGw20ojlzkVIXm3ZCMfLuZchhPlnusoatr+ukDOmE4YKkDxs0R+t8f2nJKjN
Tzt81D7rhab69H2hQvsz5DVHAiFjR8WOw6YFFw72RVQpKFOxn5HJ2LMrTi+nth7I
QKhgrPtjYMvMps5T3hpnyoQbXqiocuynijoZ072HaPDHCNi8yJA8Jiv9qah/BEeM
sCxuuf8F1c04+laSxSYmlMsFHBMpUglVZmpreRVCd/qVrrJF399/Md4R+DrWsZSm
MDr98Wk/sZw=
=uBk0
-----END PGP SIGNATURE-----

« Back to bulletins