jvndb - jvndb-2023-000091

jvndb-2023-000091

Vulnerability from jvndb

Published

2023-09-05 15:51

Modified

2024-05-14 18:06

Severity ?

9.8 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple vulnerabilities in F-RevoCRM

Details

F-RevoCRM provided by ThinkingReed inc. contains multiple vulnerabilities listed below. * OS Command Injection (CWE-78) - CVE-2023-41149 * Cross-site scripting vulnerability (CWE-79) - CVE-2023-41150 Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN78113802/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-41149
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-41150
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-41149
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-41150
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	thinkingreed	F-RevoCRM

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000091.html",
  "dc:date": "2024-05-14T18:06+09:00",
  "dcterms:issued": "2023-09-05T15:51+09:00",
  "dcterms:modified": "2024-05-14T18:06+09:00",
  "description": "F-RevoCRM provided by ThinkingReed inc. contains multiple vulnerabilities listed below.\r\n\r\n  * OS Command Injection (CWE-78) - CVE-2023-41149\r\n  * Cross-site scripting vulnerability (CWE-79) - CVE-2023-41150\r\n\r\nKentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000091.html",
  "sec:cpe": {
    "#text": "cpe:/a:f-revocrm:f-revocrm",
    "@product": "F-RevoCRM",
    "@vendor": "thinkingreed",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "9.8",
      "@severity": "Critical",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000091",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN78113802/index.html",
      "@id": "JVN#78113802",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-41149",
      "@id": "CVE-2023-41149",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-41150",
      "@id": "CVE-2023-41150",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-41149",
      "@id": "CVE-2023-41149",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-41150",
      "@id": "CVE-2023-41150",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in F-RevoCRM"
}

cve-2023-41149

Vulnerability from cvelistv5

Published

2023-09-06 12:35

Modified

2024-09-26 20:40

Severity ?

Summary

F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running.

References

▼	URL	Tags
	https://f-revocrm.jp/2023/08/9394/
	http://jvn.jp/en/jp/JVN78113802/

Impacted products

▼	Vendor	Product
	Thinkingreed Inc.	F-RevoCRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:54:04.326Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://f-revocrm.jp/2023/08/9394/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN78113802/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41149",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T20:39:55.186689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:40:04.712Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "F-RevoCRM ",
          "vendor": "Thinkingreed Inc. ",
          "versions": [
            {
              "status": "affected",
              "version": "version7.3.7 and version7.3.8 "
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OS command injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-06T12:35:22.757Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://f-revocrm.jp/2023/08/9394/"
        },
        {
          "url": "http://jvn.jp/en/jp/JVN78113802/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-41149",
    "datePublished": "2023-09-06T12:35:22.757Z",
    "dateReserved": "2023-08-24T00:34:39.254Z",
    "dateUpdated": "2024-09-26T20:40:04.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-41150

Vulnerability from cvelistv5

Published

2023-09-06 12:35

Modified

2024-09-26 19:46

Severity ?

Summary

F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.

References

▼	URL	Tags
	https://f-revocrm.jp/2023/08/9394/
	http://jvn.jp/en/jp/JVN78113802/

Impacted products

▼	Vendor	Product
	Thinkingreed Inc.	F-RevoCRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:54:03.482Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://f-revocrm.jp/2023/08/9394/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN78113802/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41150",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:46:21.442931Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T19:46:35.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "F-RevoCRM",
          "vendor": "Thinkingreed Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.3 series prior to version7.3.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-06T12:35:41.294Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://f-revocrm.jp/2023/08/9394/"
        },
        {
          "url": "http://jvn.jp/en/jp/JVN78113802/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-41150",
    "datePublished": "2023-09-06T12:35:41.294Z",
    "dateReserved": "2023-08-24T00:34:39.254Z",
    "dateUpdated": "2024-09-26T19:46:35.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

jvndb-2023-000091

Vulnerability from jvndb

cve-2023-41149

Vulnerability from cvelistv5

cve-2023-41150

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature