cvelistv5 - cve-2024-33622

CVE-2024-33622 (GCVE-0-2024-33622)

Vulnerability from cvelistv5 – Published: 2024-06-18 05:44 – Updated: 2024-11-21 15:37

Summary

Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

Missing authentication for critical function

Assigner

jpcert

References

URL

Tags

	https://www.fujitsu.com/jp/group/fsas/about/resou…
	https://jvn.jp/en/jp/JVN65171386/

Impacted products

Vendor

Product

Version

Fsas Technologies Inc.

FUJITSU Business Application ID Link Manager II

Affected: V1.8 and earlier

Fsas Technologies Inc.	FUJITSU Software ID Link Manager	Affected: V2.0
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager	Affected: V2.3.0 Affected: V2.3.1 Affected: V2.4 Affected: V2.5 Affected: V2.6 Affected: and V2.7
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager	Affected: V3.0 Affected: V3.0.2 Affected: V3.0.2.1 Affected: and V3.0.3
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager SaaS	Affected: Versions before the maintenance on June 16 Affected: 2024

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-33622",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-01T16:30:50.447465Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-306",
                "description": "CWE-306 Missing Authentication for Critical Function",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T15:37:25.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:36:04.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN65171386/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FUJITSU Business Application ID Link Manager II",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V1.8 and earlier"
            }
          ]
        },
        {
          "product": "FUJITSU Software ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.3.0"
            },
            {
              "status": "affected",
              "version": " V2.3.1"
            },
            {
              "status": "affected",
              "version": " V2.4"
            },
            {
              "status": "affected",
              "version": " V2.5"
            },
            {
              "status": "affected",
              "version": " V2.6"
            },
            {
              "status": "affected",
              "version": " and V2.7"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V3.0"
            },
            {
              "status": "affected",
              "version": " V3.0.2"
            },
            {
              "status": "affected",
              "version": " V3.0.2.1"
            },
            {
              "status": "affected",
              "version": " and V3.0.3"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager SaaS",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Versions before the maintenance on June 16"
            },
            {
              "status": "affected",
              "version": " 2024"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Missing authentication for critical function",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T05:44:18.590Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN65171386/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-33622",
    "datePublished": "2024-06-18T05:44:18.590Z",
    "dateReserved": "2024-05-22T00:24:00.288Z",
    "dateUpdated": "2024-11-21T15:37:25.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.\"}, {\"lang\": \"es\", \"value\": \"Falta autenticaci\\u00f3n para una vulnerabilidad de funci\\u00f3n cr\\u00edtica en ID Link Manager y FUJITSU Software TIME CREATOR. Si se explota esta vulnerabilidad, un atacante remoto autenticado puede obtener informaci\\u00f3n confidencial y/o la informaci\\u00f3n almacenada en la base de datos puede ser alterada.\"}]",
      "id": "CVE-2024-33622",
      "lastModified": "2024-11-21T16:15:24.577",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2024-06-18T06:15:11.163",
      "references": "[{\"url\": \"https://jvn.jp/en/jp/JVN65171386/\", \"source\": \"vultures@jpcert.or.jp\"}, {\"url\": \"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\", \"source\": \"vultures@jpcert.or.jp\"}, {\"url\": \"https://jvn.jp/en/jp/JVN65171386/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "vultures@jpcert.or.jp",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-306\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-33622\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-06-18T06:15:11.163\",\"lastModified\":\"2024-11-21T16:15:24.577\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.\"},{\"lang\":\"es\",\"value\":\"Falta autenticaci\u00f3n para una vulnerabilidad de funci\u00f3n cr\u00edtica en ID Link Manager y FUJITSU Software TIME CREATOR. Si se explota esta vulnerabilidad, un atacante remoto autenticado puede obtener informaci\u00f3n confidencial y/o la informaci\u00f3n almacenada en la base de datos puede ser alterada.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN65171386/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://jvn.jp/en/jp/JVN65171386/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://jvn.jp/en/jp/JVN65171386/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T02:36:04.055Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-33622\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-01T16:30:50.447465Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306 Missing Authentication for Critical Function\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-01T16:31:01.345Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Business Application ID Link Manager II\", \"versions\": [{\"status\": \"affected\", \"version\": \"V1.8 and earlier\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software ID Link Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V2.0\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software TIME CREATOR ID Link Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V2.3.0\"}, {\"status\": \"affected\", \"version\": \" V2.3.1\"}, {\"status\": \"affected\", \"version\": \" V2.4\"}, {\"status\": \"affected\", \"version\": \" V2.5\"}, {\"status\": \"affected\", \"version\": \" V2.6\"}, {\"status\": \"affected\", \"version\": \" and V2.7\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software TIME CREATOR ID Link Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.0\"}, {\"status\": \"affected\", \"version\": \" V3.0.2\"}, {\"status\": \"affected\", \"version\": \" V3.0.2.1\"}, {\"status\": \"affected\", \"version\": \" and V3.0.3\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software TIME CREATOR ID Link Manager SaaS\", \"versions\": [{\"status\": \"affected\", \"version\": \"Versions before the maintenance on June 16\"}, {\"status\": \"affected\", \"version\": \" 2024\"}]}], \"references\": [{\"url\": \"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\"}, {\"url\": \"https://jvn.jp/en/jp/JVN65171386/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Missing authentication for critical function\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2024-06-18T05:44:18.590Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-33622\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-21T15:37:25.545Z\", \"dateReserved\": \"2024-05-22T00:24:00.288Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2024-06-18T05:44:18.590Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-9VWW-2CQ4-Q8XH

Vulnerability from github – Published: 2024-06-18 06:30 – Updated: 2024-06-18 06:30

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-33622"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-18T06:15:11Z",
    "severity": null
  },
  "details": "Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.",
  "id": "GHSA-9vww-2cq4-q8xh",
  "modified": "2024-06-18T06:30:41Z",
  "published": "2024-06-18T06:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33622"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN65171386"
    },
    {
      "type": "WEB",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

FKIE_CVE-2024-33622

Vulnerability from fkie_nvd - Published: 2024-06-18 06:15 - Updated: 2024-11-21 16:15

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN65171386/
	vultures@jpcert.or.jp	https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html
	af854a3a-2127-422b-91ae-364da2661108	https://jvn.jp/en/jp/JVN65171386/
	af854a3a-2127-422b-91ae-364da2661108	https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker."
    },
    {
      "lang": "es",
      "value": "Falta autenticaci\u00f3n para una vulnerabilidad de funci\u00f3n cr\u00edtica en ID Link Manager y FUJITSU Software TIME CREATOR. Si se explota esta vulnerabilidad, un atacante remoto autenticado puede obtener informaci\u00f3n confidencial y/o la informaci\u00f3n almacenada en la base de datos puede ser alterada."
    }
  ],
  "id": "CVE-2024-33622",
  "lastModified": "2024-11-21T16:15:24.577",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-06-18T06:15:11.163",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/jp/JVN65171386/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://jvn.jp/en/jp/JVN65171386/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

JVNDB-2024-000063

Vulnerability from jvndb - Published: 2024-06-18 13:43 - Updated:2024-06-18 13:43

Severity ?

8.6 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

Multiple vulnerabilities in ID Link Manager and FUJITSU Software TIME CREATOR

Details

ID Link Manager and FUJITSU Software TIME CREATOR provided by Fsas Technologies Inc. contain multiple vulnerabilities listed below. * Path Traversal (CWE-36) (CVE-2024-33620) * Missing Authentication (CWE-306) (CVE-2024-33622) * Information disclosure (CWE-204) (CVE-2024-34024) Christian Demko of WithSecure KK reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer Fsas Technologies Inc.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN65171386/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-33620
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-33622
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-34024
	Information Exposure(CWE-200)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Improper Authentication(CWE-287)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	Fsas Technologies Inc.	FUJITSU Business Application ID Link ManagerII
	Fsas Technologies Inc.	FUJITSU Software ID Link Manager
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000063.html",
  "dc:date": "2024-06-18T13:43+09:00",
  "dcterms:issued": "2024-06-18T13:43+09:00",
  "dcterms:modified": "2024-06-18T13:43+09:00",
  "description": "ID Link Manager and FUJITSU Software TIME CREATOR provided by Fsas Technologies Inc. contain multiple vulnerabilities listed below.\r\n\r\n* Path Traversal (CWE-36) (CVE-2024-33620)\r\n* Missing Authentication (CWE-306) (CVE-2024-33622)\r\n* Information disclosure (CWE-204) (CVE-2024-34024)\r\n\r\nChristian Demko of WithSecure KK reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer Fsas Technologies Inc.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000063.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:misc:fsas_technologies_fujitsu_business_application_id_link_manager2",
      "@product": "FUJITSU Business Application ID Link ManagerII",
      "@vendor": "Fsas Technologies Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:fsas_technologies_fujitsu_software_id_link_manager",
      "@product": "FUJITSU Software ID Link Manager",
      "@vendor": "Fsas Technologies Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:fsas_technologies_fujitsu_software_time_creator_id_link_manager",
      "@product": "FUJITSU Software TIME CREATOR ID Link Manager",
      "@vendor": "Fsas Technologies Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.6",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000063",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN65171386/index.html",
      "@id": "JVN#65171386",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-33620",
      "@id": "CVE-2024-33620",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-33622",
      "@id": "CVE-2024-33622",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-34024",
      "@id": "CVE-2024-34024",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-287",
      "@title": "Improper Authentication(CWE-287)"
    }
  ],
  "title": "Multiple vulnerabilities in ID Link Manager and FUJITSU Software TIME CREATOR"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-33622 (GCVE-0-2024-33622)

GHSA-9VWW-2CQ4-Q8XH

FKIE_CVE-2024-33622

JVNDB-2024-000063

Tags

Sightings

Nomenclature