CVE-2017-2154

moderate-risk
Published 2017-04-28

Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST Frontier 3, JUST School 6 Premium, Hanako Police 5, JUST Police 3, Hanako 2017 trial version allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

Do I need to act?

-
0.30% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (15)

Hanako
Hanako
Hanako Police
Hanako Pro
Just Office
Just Office
Just Police
Just School
Just School
Hanako
Hanako
Just Frontier
Just Government
Just Jump Class
Just Office

Affected Vendors

Justsystems

References (4)

Third Party Advisory https://jvn.jp/en/jp/JVN54268888/index.html
Vendor Advisory https://www.justsystems.com/jp/info/js17002.html
Third Party Advisory https://jvn.jp/en/jp/JVN54268888/index.html
Vendor Advisory https://www.justsystems.com/jp/info/js17002.html
43
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 1/34 · Minimal
Exposure 18/34 · Moderate