jvndb - jvndb-2023-007152

jvndb-2023-007152

Vulnerability from jvndb

Published

2023-11-20 14:09

Modified

2024-05-01 18:10

Severity ?

8.8 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple vulnerabilities in EXPRESSCLUSTER X

Details

WebManager/Cluster WebUI of EXPRESSCLUSTER X provided by NEC Corporation contains multiple vulnerabilities listed below. * Missing authorization (CWE-862) - CVE-2023-39544 * Files or directories accessible to external parties (CWE-552) - CVE-2023-39545 * Use of password hash instead of password for authentication (CWE-836) - CVE-2023-39546 * Authentication bypass by Capture-replay (CWE-294) - CVE-2023-39547 * Unrestricted upload of file with dangerous type (CWE-434) - CVE-2023-39548

References

▼	Type	URL
	JVN	https://jvn.jp/en/vu/JVNVU98954968/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39544
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39545
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39546
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39547
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-39548
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39544
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39545
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39546
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39547
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-39548
	Authentication Bypass by Capture-replay(CWE-294)	https://cwe.mitre.org/data/definitions/294.html
	Unrestricted Upload of File with Dangerous Type(CWE-434)	https://cwe.mitre.org/data/definitions/434.html
	Files or Directories Accessible to External Parties(CWE-552)	https://cwe.mitre.org/data/definitions/552.html
	Use of Password Hash Instead of Password for Authentication(CWE-836)	https://cwe.mitre.org/data/definitions/836.html
	Missing Authorization(CWE-862)	https://cwe.mitre.org/data/definitions/862.html

Impacted products

▼	Vendor	Product
	NEC Corporation	EXPRESSCLUSTER X
	NEC Corporation	EXPRESSCLUSTER SingleServerSafe

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-007152.html",
  "dc:date": "2024-05-01T18:10+09:00",
  "dcterms:issued": "2023-11-20T14:09+09:00",
  "dcterms:modified": "2024-05-01T18:10+09:00",
  "description": "WebManager/Cluster WebUI of EXPRESSCLUSTER X provided by NEC Corporation contains multiple vulnerabilities listed below.\r\n\r\n  * Missing authorization (CWE-862) - CVE-2023-39544\r\n  * Files or directories accessible to external parties (CWE-552) - CVE-2023-39545\r\n  * Use of password hash instead of password for authentication (CWE-836) - CVE-2023-39546\r\n  * Authentication bypass by Capture-replay (CWE-294) - CVE-2023-39547\r\n  * Unrestricted upload of file with dangerous type (CWE-434) - CVE-2023-39548",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-007152.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:nec:expresscluster_x",
      "@product": "EXPRESSCLUSTER X",
      "@vendor": "NEC Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:nec:expresscluster_x_singleserversafe",
      "@product": "EXPRESSCLUSTER SingleServerSafe",
      "@vendor": "NEC Corporation",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2023-007152",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU98954968/index.html",
      "@id": "JVNVU#98954968",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39544",
      "@id": "CVE-2023-39544",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39545",
      "@id": "CVE-2023-39545",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39546",
      "@id": "CVE-2023-39546",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39547",
      "@id": "CVE-2023-39547",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39548",
      "@id": "CVE-2023-39548",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39544",
      "@id": "CVE-2023-39544",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39545",
      "@id": "CVE-2023-39545",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39546",
      "@id": "CVE-2023-39546",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39547",
      "@id": "CVE-2023-39547",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39548",
      "@id": "CVE-2023-39548",
      "@source": "NVD"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/294.html",
      "@id": "CWE-294",
      "@title": "Authentication Bypass by Capture-replay(CWE-294)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/434.html",
      "@id": "CWE-434",
      "@title": "Unrestricted Upload of File with Dangerous Type(CWE-434)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/552.html",
      "@id": "CWE-552",
      "@title": "Files or Directories Accessible to External Parties(CWE-552)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/836.html",
      "@id": "CWE-836",
      "@title": "Use of Password Hash Instead of Password for Authentication(CWE-836)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/862.html",
      "@id": "CWE-862",
      "@title": "Missing Authorization(CWE-862)"
    }
  ],
  "title": "Multiple vulnerabilities in EXPRESSCLUSTER X"
}

cve-2023-39547

Vulnerability from cvelistv5

Published

2023-11-17 05:31

Modified

2024-08-29 14:27

Severity ?

Summary

CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.

References

▼	URL	Tags
	https://jpn.nec.com/security-info/secinfo/nv23-009_en.html

Impacted products

▼	Vendor	Product
	NEC Corporation	CLUSTERPRO X (EXPRESSCLUSTER X)
	NEC Corporation	CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:10:21.401Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nec_corporation:clusterpro_x_singleserversafe\\/expresscluster_x_singleserversafe\\/:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "clusterpro_x_singleserversafe\\/expresscluster_x_singleserversafe\\/",
            "vendor": "nec_corporation",
            "versions": [
              {
                "status": "affected",
                "version": "1.0"
              },
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "3.0"
              },
              {
                "status": "affected",
                "version": "3.1"
              },
              {
                "status": "affected",
                "version": "3.2"
              },
              {
                "status": "affected",
                "version": "4.0"
              },
              {
                "status": "affected",
                "version": "4.1"
              },
              {
                "status": "affected",
                "version": "4.2"
              },
              {
                "status": "affected",
                "version": "5.0"
              },
              {
                "status": "affected",
                "version": "5.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39547",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-29T14:25:13.395504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T14:27:49.456Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CLUSTERPRO X (EXPRESSCLUSTER X)",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1"
            }
          ]
        },
        {
          "product": "CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Mr. David Levard in Videotron."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.\u003c/p\u003e"
            }
          ],
          "value": "CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294 Authentication bypass by Capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-24T11:50:37.452Z",
        "orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
        "shortName": "NEC"
      },
      "references": [
        {
          "url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
    "assignerShortName": "NEC",
    "cveId": "CVE-2023-39547",
    "datePublished": "2023-11-17T05:31:27.701Z",
    "dateReserved": "2023-08-04T07:22:19.322Z",
    "dateUpdated": "2024-08-29T14:27:49.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-39546

Vulnerability from cvelistv5

Published

2023-11-17 05:31

Modified

2024-08-29 14:33

Severity ?

Summary

References

▼	URL	Tags
	https://jpn.nec.com/security-info/secinfo/nv23-009_en.html

Impacted products

▼	Vendor	Product
	NEC Corporation	CLUSTERPRO X (EXPRESSCLUSTER X)
	NEC Corporation	CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:10:21.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39546",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-29T14:33:00.592206Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T14:33:29.801Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CLUSTERPRO X (EXPRESSCLUSTER X)",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1"
            }
          ]
        },
        {
          "product": "CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Mr. David Levard in Videotron."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.\u003c/p\u003e"
            }
          ],
          "value": "CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-836",
              "description": "CWE-836 Use of password hash instead of password for authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-24T11:49:51.705Z",
        "orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
        "shortName": "NEC"
      },
      "references": [
        {
          "url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
    "assignerShortName": "NEC",
    "cveId": "CVE-2023-39546",
    "datePublished": "2023-11-17T05:31:08.331Z",
    "dateReserved": "2023-08-04T07:22:19.322Z",
    "dateUpdated": "2024-08-29T14:33:29.801Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-39544

Vulnerability from cvelistv5

Published

2023-11-17 05:28

Modified

2024-08-29 14:33

Severity ?

Summary

References

▼	URL	Tags
	https://jpn.nec.com/security-info/secinfo/nv23-009_en.html

Impacted products

▼	Vendor	Product
	NEC Corporation	CLUSTERPRO X(EXPRESSCLUSTER X)
	NEC Corporation	CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:10:21.455Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39544",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-29T14:32:23.652468Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T14:33:42.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CLUSTERPRO X(EXPRESSCLUSTER X)",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1"
            }
          ]
        },
        {
          "product": "CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Mr. David Levard in Videotron."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.\u003c/p\u003e"
            }
          ],
          "value": "CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-24T11:48:56.515Z",
        "orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
        "shortName": "NEC"
      },
      "references": [
        {
          "url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
    "assignerShortName": "NEC",
    "cveId": "CVE-2023-39544",
    "datePublished": "2023-11-17T05:28:26.493Z",
    "dateReserved": "2023-08-04T07:22:19.321Z",
    "dateUpdated": "2024-08-29T14:33:42.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-39548

Vulnerability from cvelistv5

Published

2023-11-17 05:31

Modified

2024-08-29 14:23

Severity ?

Summary

References

▼	URL	Tags
	https://jpn.nec.com/security-info/secinfo/nv23-009_en.html

Impacted products

▼	Vendor	Product
	NEC Corporation	CLUSTERPRO X (EXPRESSCLUSTER X)
	NEC Corporation	CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:10:21.146Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nec_corporation:clusterpro_x_singleserversafe\\/expresscluster_x_singleserversafe\\/:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "clusterpro_x_singleserversafe\\/expresscluster_x_singleserversafe\\/",
            "vendor": "nec_corporation",
            "versions": [
              {
                "status": "affected",
                "version": "1.0"
              },
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "3.0"
              },
              {
                "status": "affected",
                "version": "3.1"
              },
              {
                "status": "affected",
                "version": "3.2"
              },
              {
                "status": "affected",
                "version": "4.0"
              },
              {
                "status": "affected",
                "version": "4.1"
              },
              {
                "status": "affected",
                "version": "4.2"
              },
              {
                "status": "affected",
                "version": "5.0"
              },
              {
                "status": "affected",
                "version": "5.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39548",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-29T14:17:21.435014Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T14:23:27.568Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CLUSTERPRO X (EXPRESSCLUSTER X)",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1"
            }
          ]
        },
        {
          "product": "CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Mr. David Levard in Videotron."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.\u003c/p\u003e"
            }
          ],
          "value": "CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted upload of file with dangerous type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-24T11:51:09.351Z",
        "orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
        "shortName": "NEC"
      },
      "references": [
        {
          "url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
    "assignerShortName": "NEC",
    "cveId": "CVE-2023-39548",
    "datePublished": "2023-11-17T05:31:40.336Z",
    "dateReserved": "2023-08-04T07:22:19.322Z",
    "dateUpdated": "2024-08-29T14:23:27.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-39545

Vulnerability from cvelistv5

Published

2023-11-17 05:30

Modified

2024-08-29 14:31

Severity ?

Summary

References

▼	URL	Tags
	https://jpn.nec.com/security-info/secinfo/nv23-009_en.html

Impacted products

▼	Vendor	Product
	NEC Corporation	CLUSTERPRO X (EXPRESSCLUSTER X)
	NEC Corporation	CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:10:21.356Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-39545",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-29T14:29:22.540390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T14:31:29.147Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CLUSTERPRO X (EXPRESSCLUSTER X)",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1"
            }
          ]
        },
        {
          "product": "CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Mr. David Levard in Videotron."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.\u003c/p\u003e"
            }
          ],
          "value": "CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552 Files or directories accessible to external parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-24T11:49:21.575Z",
        "orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
        "shortName": "NEC"
      },
      "references": [
        {
          "url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
    "assignerShortName": "NEC",
    "cveId": "CVE-2023-39545",
    "datePublished": "2023-11-17T05:30:10.859Z",
    "dateReserved": "2023-08-04T07:22:19.322Z",
    "dateUpdated": "2024-08-29T14:31:29.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

jvndb-2023-007152

Vulnerability from jvndb

cve-2023-39547

Vulnerability from cvelistv5

cve-2023-39546

Vulnerability from cvelistv5

cve-2023-39544

Vulnerability from cvelistv5

cve-2023-39548

Vulnerability from cvelistv5

cve-2023-39545

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature