AssetView Missing Authentication and Sensitive Info Disclosure Vulnerability (JVN#26321838)

Critical Vulnerability Information Vulnerability ID JVN#26321838 Affected Versions AssetView - Versions prior to Ver 13.2.4.3308 (13.2.4) - Versions after Ver 13.2.4.3308 (13.2.4), excluding AssetView Cloud AssetView Cloud - Versions after Ver 13.2.4.3308 (13.2.4) Vulnerability Description 1. Lack of Authentication for Critical Functions - Insufficient authentication for server internal file overwriting or deletion, and for communication between the management console and server, may allow external third parties to access server internal files by spoofing communication. 2. Exposure of Sensitive Information Sent to Developers - Sensitive information is included in data sent from the management console to Hamock. Attackers can obtain this information via man-in-the-middle attacks. Mitigation Measures AssetView - Download and install the required AssetView installer and manual tools via the web site to apply patches. AssetView Cloud - HTTP interface has been encrypted, significantly reducing the likelihood of exploitation. Contracted users will receive notifications regarding partial security setting changes. Update History May 25, 2023: This vulnerability information page was made public. Contact Information AssetView Support Group - Phone: 03-5291-6137 (Business hours: 09:00–12:00, 13:00–17:00, excluding holidays) Inquiry Form E-C Sales Department - Phone: 0120-922-786 (Business hours: 09:00–12:00, 13:00–17:00, excluding holidays) ``` This summary outlines the key details of the vulnerability, including affected versions, types of vulnerabilities, mitigation steps, and contact information for support.

Goal Reached Thanks to every supporter — we hit 100%!

AssetView Missing Authentication and Sensitive Info Disclosure Vulnerability (JVN#26321838)