github - ghsa-prj9-gvpq-vj8x

ghsa-prj9-gvpq-vj8x

Vulnerability from github

Published

2024-06-18 06:30

Modified

2024-11-16 00:31

Severity ?

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-34024"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-18T06:15:11Z",
    "severity": "MODERATE"
  },
  "details": "Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not.",
  "id": "GHSA-prj9-gvpq-vj8x",
  "modified": "2024-11-16T00:31:49Z",
  "published": "2024-06-18T06:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34024"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN65171386"
    },
    {
      "type": "WEB",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-34024

Vulnerability from cvelistv5

Published

2024-06-18 05:44

Modified

2024-11-15 20:34

Severity ?

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

References

▼	URL	Tags
	https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html
	https://jvn.jp/en/jp/JVN65171386/

Impacted products

▼	Vendor	Product
	Fsas Technologies Inc.	FUJITSU Business Application ID Link Manager II
	Fsas Technologies Inc.	FUJITSU Software ID Link Manager
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager SaaS

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-34024",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-18T13:28:09.078006Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T20:34:45.643Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:42:59.931Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN65171386/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FUJITSU Business Application ID Link Manager II",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V1.8 and earlier"
            }
          ]
        },
        {
          "product": "FUJITSU Software ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.3.0"
            },
            {
              "status": "affected",
              "version": " V2.3.1"
            },
            {
              "status": "affected",
              "version": " V2.4"
            },
            {
              "status": "affected",
              "version": " V2.5"
            },
            {
              "status": "affected",
              "version": " V2.6"
            },
            {
              "status": "affected",
              "version": " and V2.7"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V3.0"
            },
            {
              "status": "affected",
              "version": " V3.0.2"
            },
            {
              "status": "affected",
              "version": " V3.0.2.1"
            },
            {
              "status": "affected",
              "version": " and V3.0.3"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager SaaS",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Versions before the maintenance on June 16"
            },
            {
              "status": "affected",
              "version": " 2024"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Observable response discrepancy",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T05:44:59.077Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN65171386/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-34024",
    "datePublished": "2024-06-18T05:44:59.077Z",
    "dateReserved": "2024-05-22T00:24:01.201Z",
    "dateUpdated": "2024-11-15T20:34:45.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted