github - ghsa-577f-9hhg-fc2w

ghsa-577f-9hhg-fc2w

Vulnerability from github

Published

2024-06-18 06:30

Modified

2024-08-13 21:31

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Details

Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents including sensitive information on the server may be retrieved by an unauthenticated remote attacker.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-33620"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-36"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-18T06:15:11Z",
    "severity": "HIGH"
  },
  "details": "Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents including sensitive information on the server may be retrieved by an unauthenticated remote attacker.",
  "id": "GHSA-577f-9hhg-fc2w",
  "modified": "2024-08-13T21:31:55Z",
  "published": "2024-06-18T06:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33620"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN65171386"
    },
    {
      "type": "WEB",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-33620

Vulnerability from cvelistv5

Published

2024-06-18 05:44

Modified

2024-08-13 19:17

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

References

▼	URL	Tags
	https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html
	https://jvn.jp/en/jp/JVN65171386/

Impacted products

▼	Vendor	Product
	Fsas Technologies Inc.	FUJITSU Business Application ID Link Manager II
	Fsas Technologies Inc.	FUJITSU Software ID Link Manager
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:36:04.361Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN65171386/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:business_application_id_link_manager_ii:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "business_application_id_link_manager_ii",
            "vendor": "fujitsu",
            "versions": [
              {
                "lessThanOrEqual": "1.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:id_link_manager:2.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:time_creator_id_link_manager:2.3.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "time_creator_id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "2.3.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:time_creator_id_link_manager:2.3.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "time_creator_id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "2.3.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:time_creator_id_link_manager:2.4:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "time_creator_id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "2.4"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:time_creator_id_link_manager:2.5:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "time_creator_id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "2.5"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:time_creator_id_link_manager:2.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "time_creator_id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "2.6"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:time_creator_id_link_manager:2.7:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "time_creator_id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "2.7"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:time_creator_id_link_manager:3.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "time_creator_id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "3.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:time_creator_id_link_manager:3.0.2:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "time_creator_id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "3.0.2"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:time_creator_id_link_manager:3.0.2.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "time_creator_id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "3.0.2.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fujitsu:time_creator_id_link_manager:3.0.3:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "time_creator_id_link_manager",
            "vendor": "fujitsu",
            "versions": [
              {
                "status": "affected",
                "version": "3.0.3"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.6,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-33620",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-12T17:27:20.527344Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-36",
                "description": "CWE-36 Absolute Path Traversal",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-13T19:17:23.562Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FUJITSU Business Application ID Link Manager II",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V1.8 and earlier"
            }
          ]
        },
        {
          "product": "FUJITSU Software ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.3.0"
            },
            {
              "status": "affected",
              "version": " V2.3.1"
            },
            {
              "status": "affected",
              "version": " V2.4"
            },
            {
              "status": "affected",
              "version": " V2.5"
            },
            {
              "status": "affected",
              "version": " V2.6"
            },
            {
              "status": "affected",
              "version": " and V2.7"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V3.0"
            },
            {
              "status": "affected",
              "version": " V3.0.2"
            },
            {
              "status": "affected",
              "version": " V3.0.2.1"
            },
            {
              "status": "affected",
              "version": " and V3.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents including sensitive information on the server may be retrieved by an unauthenticated remote attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Absolute path traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T05:44:53.121Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN65171386/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-33620",
    "datePublished": "2024-06-18T05:44:53.121Z",
    "dateReserved": "2024-05-22T00:23:59.245Z",
    "dateUpdated": "2024-08-13T19:17:23.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted