Vulnerability-Lookup

CVE-2024-34024 (GCVE-0-2024-34024)

Vulnerability from cvelistv5 – Published: 2024-06-18 05:44 – Updated: 2024-11-15 20:34

Summary

Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-18 13:28 UTC

CWE

Observable response discrepancy
CWE-noinfo Not enough information

Assigner

jpcert jpcert root

References

2 references

URL	Tags
https://www.fujitsu.com/jp/group/fsas/about/resou…
https://jvn.jp/en/jp/JVN65171386/

Impacted products

5 products

Vendor	Product	Version	CPE status
Fsas Technologies Inc.	FUJITSU Business Application ID Link Manager II	Affected: V1.8 and earlier	guessed
Fsas Technologies Inc.	FUJITSU Software ID Link Manager	Affected: V2.0	guessed
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager	Affected: V2.3.0 Affected: V2.3.1 Affected: V2.4 Affected: V2.5 Affected: V2.6 Affected: and V2.7	guessed
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager	Affected: V3.0 Affected: V3.0.2 Affected: V3.0.2.1 Affected: and V3.0.3	guessed
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager SaaS	Affected: Versions before the maintenance on June 16 Affected: 2024	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-34024",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-18T13:28:09.078006Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T20:34:45.643Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:42:59.931Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN65171386/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FUJITSU Business Application ID Link Manager II",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V1.8 and earlier"
            }
          ]
        },
        {
          "product": "FUJITSU Software ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.3.0"
            },
            {
              "status": "affected",
              "version": " V2.3.1"
            },
            {
              "status": "affected",
              "version": " V2.4"
            },
            {
              "status": "affected",
              "version": " V2.5"
            },
            {
              "status": "affected",
              "version": " V2.6"
            },
            {
              "status": "affected",
              "version": " and V2.7"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V3.0"
            },
            {
              "status": "affected",
              "version": " V3.0.2"
            },
            {
              "status": "affected",
              "version": " V3.0.2.1"
            },
            {
              "status": "affected",
              "version": " and V3.0.3"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager SaaS",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Versions before the maintenance on June 16"
            },
            {
              "status": "affected",
              "version": " 2024"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Observable response discrepancy",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T05:44:59.077Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN65171386/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-34024",
    "datePublished": "2024-06-18T05:44:59.077Z",
    "dateReserved": "2024-05-22T00:24:01.201Z",
    "dateUpdated": "2024-11-15T20:34:45.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-34024",
      "date": "2026-09-15",
      "epss": "0.00359",
      "percentile": "0.2932"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not.\"}, {\"lang\": \"es\", \"value\": \"Existe un problema de discrepancia de respuesta observable en ID Link Manager y FUJITSU Software TIME CREATOR. Si se explota esta vulnerabilidad, un atacante remoto no autenticado puede determinar si un nombre de usuario es v\\u00e1lido o no.\"}]",
      "id": "CVE-2024-34024",
      "lastModified": "2024-11-21T09:17:56.090",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.4}]}",
      "published": "2024-06-18T06:15:11.257",
      "references": "[{\"url\": \"https://jvn.jp/en/jp/JVN65171386/\", \"source\": \"vultures@jpcert.or.jp\"}, {\"url\": \"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\", \"source\": \"vultures@jpcert.or.jp\"}, {\"url\": \"https://jvn.jp/en/jp/JVN65171386/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "vultures@jpcert.or.jp",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-34024\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-06-18T06:15:11.257\",\"lastModified\":\"2026-06-17T07:32:46.097\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not.\"},{\"lang\":\"es\",\"value\":\"Existe un problema de discrepancia de respuesta observable en ID Link Manager y FUJITSU Software TIME CREATOR. Si se explota esta vulnerabilidad, un atacante remoto no autenticado puede determinar si un nombre de usuario es v\u00e1lido o no.\"}],\"affected\":[{\"source\":\"vultures@jpcert.or.jp\",\"affectedData\":[{\"vendor\":\"Fsas Technologies Inc.\",\"product\":\"FUJITSU Business Application ID Link Manager II\",\"versions\":[{\"version\":\"V1.8 and earlier\",\"status\":\"affected\"}]},{\"vendor\":\"Fsas Technologies Inc.\",\"product\":\"FUJITSU Software ID Link Manager\",\"versions\":[{\"version\":\"V2.0\",\"status\":\"affected\"}]},{\"vendor\":\"Fsas Technologies Inc.\",\"product\":\"FUJITSU Software TIME CREATOR ID Link Manager\",\"versions\":[{\"version\":\"V2.3.0\",\"status\":\"affected\"},{\"version\":\" V2.3.1\",\"status\":\"affected\"},{\"version\":\" V2.4\",\"status\":\"affected\"},{\"version\":\" V2.5\",\"status\":\"affected\"},{\"version\":\" V2.6\",\"status\":\"affected\"},{\"version\":\" and V2.7\",\"status\":\"affected\"}]},{\"vendor\":\"Fsas Technologies Inc.\",\"product\":\"FUJITSU Software TIME CREATOR ID Link Manager\",\"versions\":[{\"version\":\"V3.0\",\"status\":\"affected\"},{\"version\":\" V3.0.2\",\"status\":\"affected\"},{\"version\":\" V3.0.2.1\",\"status\":\"affected\"},{\"version\":\" and V3.0.3\",\"status\":\"affected\"}]},{\"vendor\":\"Fsas Technologies Inc.\",\"product\":\"FUJITSU Software TIME CREATOR ID Link Manager SaaS\",\"versions\":[{\"version\":\"Versions before the maintenance on June 16\",\"status\":\"affected\"},{\"version\":\" 2024\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":3.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-18T13:28:09.078006Z\",\"id\":\"CVE-2024-34024\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN65171386/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://jvn.jp/en/jp/JVN65171386/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://jvn.jp/en/jp/JVN65171386/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T02:42:59.931Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-34024\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-18T13:28:09.078006Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-18T13:28:13.819Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Business Application ID Link Manager II\", \"versions\": [{\"status\": \"affected\", \"version\": \"V1.8 and earlier\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software ID Link Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V2.0\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software TIME CREATOR ID Link Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V2.3.0\"}, {\"status\": \"affected\", \"version\": \" V2.3.1\"}, {\"status\": \"affected\", \"version\": \" V2.4\"}, {\"status\": \"affected\", \"version\": \" V2.5\"}, {\"status\": \"affected\", \"version\": \" V2.6\"}, {\"status\": \"affected\", \"version\": \" and V2.7\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software TIME CREATOR ID Link Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.0\"}, {\"status\": \"affected\", \"version\": \" V3.0.2\"}, {\"status\": \"affected\", \"version\": \" V3.0.2.1\"}, {\"status\": \"affected\", \"version\": \" and V3.0.3\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software TIME CREATOR ID Link Manager SaaS\", \"versions\": [{\"status\": \"affected\", \"version\": \"Versions before the maintenance on June 16\"}, {\"status\": \"affected\", \"version\": \" 2024\"}]}], \"references\": [{\"url\": \"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\"}, {\"url\": \"https://jvn.jp/en/jp/JVN65171386/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Observable response discrepancy\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2024-06-18T05:44:59.077Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-34024\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-15T20:34:45.643Z\", \"dateReserved\": \"2024-05-22T00:24:01.201Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2024-06-18T05:44:59.077Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-34024

Vulnerability from fkie_nvd - Published: 2024-06-18 06:15 - Updated: 2026-06-17 07:32

Severity

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN65171386/
	vultures@jpcert.or.jp	https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html
	af854a3a-2127-422b-91ae-364da2661108	https://jvn.jp/en/jp/JVN65171386/
	af854a3a-2127-422b-91ae-364da2661108	https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "FUJITSU Business Application ID Link Manager II",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V1.8 and earlier"
            }
          ]
        },
        {
          "product": "FUJITSU Software ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.3.0"
            },
            {
              "status": "affected",
              "version": " V2.3.1"
            },
            {
              "status": "affected",
              "version": " V2.4"
            },
            {
              "status": "affected",
              "version": " V2.5"
            },
            {
              "status": "affected",
              "version": " V2.6"
            },
            {
              "status": "affected",
              "version": " and V2.7"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V3.0"
            },
            {
              "status": "affected",
              "version": " V3.0.2"
            },
            {
              "status": "affected",
              "version": " V3.0.2.1"
            },
            {
              "status": "affected",
              "version": " and V3.0.3"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager SaaS",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Versions before the maintenance on June 16"
            },
            {
              "status": "affected",
              "version": " 2024"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not."
    },
    {
      "lang": "es",
      "value": "Existe un problema de discrepancia de respuesta observable en ID Link Manager y FUJITSU Software TIME CREATOR. Si se explota esta vulnerabilidad, un atacante remoto no autenticado puede determinar si un nombre de usuario es v\u00e1lido o no."
    }
  ],
  "id": "CVE-2024-34024",
  "lastModified": "2026-06-17T07:32:46.097",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34024",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-06-18T13:28:09.078006Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-06-18T06:15:11.257",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/jp/JVN65171386/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://jvn.jp/en/jp/JVN65171386/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred"
}

GHSA-PRJ9-GVPQ-VJ8X

Vulnerability from github – Published: 2024-06-18 06:30 – Updated: 2024-11-16 00:31

Details

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-34024"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-18T06:15:11Z",
    "severity": "MODERATE"
  },
  "details": "Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not.",
  "id": "GHSA-prj9-gvpq-vj8x",
  "modified": "2024-11-16T00:31:49Z",
  "published": "2024-06-18T06:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34024"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN65171386"
    },
    {
      "type": "WEB",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

JVNDB-2024-000063

Vulnerability from jvndb - Published: 2024-06-18 04:43 - Updated:2024-06-18 04:43

Severity

8.6 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

Multiple vulnerabilities in ID Link Manager and FUJITSU Software TIME CREATOR

Details

ID Link Manager and FUJITSU Software TIME CREATOR provided by Fsas Technologies Inc. contain multiple vulnerabilities listed below. * Path Traversal (CWE-36) (CVE-2024-33620) * Missing Authentication (CWE-306) (CVE-2024-33622) * Information disclosure (CWE-204) (CVE-2024-34024) Christian Demko of WithSecure KK reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer Fsas Technologies Inc.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN65171386/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-33620
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-33622
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-34024
	Information Exposure(CWE-200)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Improper Authentication(CWE-287)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	Fsas Technologies Inc.	FUJITSU Business Application ID Link ManagerII
	Fsas Technologies Inc.	FUJITSU Software ID Link Manager
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000063.html",
  "dc:date": "2024-06-18T13:43+09:00",
  "dcterms:issued": "2024-06-18T13:43+09:00",
  "dcterms:modified": "2024-06-18T13:43+09:00",
  "description": "ID Link Manager and FUJITSU Software TIME CREATOR provided by Fsas Technologies Inc. contain multiple vulnerabilities listed below.\r\n\r\n* Path Traversal (CWE-36) (CVE-2024-33620)\r\n* Missing Authentication (CWE-306) (CVE-2024-33622)\r\n* Information disclosure (CWE-204) (CVE-2024-34024)\r\n\r\nChristian Demko of WithSecure KK reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer Fsas Technologies Inc.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000063.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:misc:fsas_technologies_fujitsu_business_application_id_link_manager2",
      "@product": "FUJITSU Business Application ID Link ManagerII",
      "@vendor": "Fsas Technologies Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:fsas_technologies_fujitsu_software_id_link_manager",
      "@product": "FUJITSU Software ID Link Manager",
      "@vendor": "Fsas Technologies Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:fsas_technologies_fujitsu_software_time_creator_id_link_manager",
      "@product": "FUJITSU Software TIME CREATOR ID Link Manager",
      "@vendor": "Fsas Technologies Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.6",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000063",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN65171386/index.html",
      "@id": "JVN#65171386",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-33620",
      "@id": "CVE-2024-33620",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-33622",
      "@id": "CVE-2024-33622",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-34024",
      "@id": "CVE-2024-34024",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-287",
      "@title": "Improper Authentication(CWE-287)"
    }
  ],
  "title": "Multiple vulnerabilities in ID Link Manager and FUJITSU Software TIME CREATOR"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-34024 (GCVE-0-2024-34024)

FKIE_CVE-2024-34024

GHSA-PRJ9-GVPQ-VJ8X

JVNDB-2024-000063

Tags

Sightings

Nomenclature

Related by attack behaviour