github - ghsa-9vww-2cq4-q8xh

ghsa-9vww-2cq4-q8xh

Vulnerability from github

Published

2024-06-18 06:30

Modified

2024-06-18 06:30

Details

Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-33622"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-18T06:15:11Z",
    "severity": null
  },
  "details": "Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.",
  "id": "GHSA-9vww-2cq4-q8xh",
  "modified": "2024-06-18T06:30:41Z",
  "published": "2024-06-18T06:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33622"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN65171386"
    },
    {
      "type": "WEB",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2024-33622 (GCVE-0-2024-33622)

Vulnerability from cvelistv5

Published

2024-06-18 05:44

Modified

2024-11-21 15:37

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

Missing authentication for critical function

Summary

Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.

References

URL

Tags

	https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html
	https://jvn.jp/en/jp/JVN65171386/

Impacted products

Vendor

Product

Version

Fsas Technologies Inc.

FUJITSU Business Application ID Link Manager II

Version: V1.8 and earlier

	Fsas Technologies Inc.	FUJITSU Software ID Link Manager	Version: V2.0
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager	Version: V2.3.0 Version: V2.3.1 Version: V2.4 Version: V2.5 Version: V2.6 Version: and V2.7
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager	Version: V3.0 Version: V3.0.2 Version: V3.0.2.1 Version: and V3.0.3
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager SaaS	Version: Versions before the maintenance on June 16 Version: 2024

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-33622",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-01T16:30:50.447465Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-306",
                "description": "CWE-306 Missing Authentication for Critical Function",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T15:37:25.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:36:04.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN65171386/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FUJITSU Business Application ID Link Manager II",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V1.8 and earlier"
            }
          ]
        },
        {
          "product": "FUJITSU Software ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.3.0"
            },
            {
              "status": "affected",
              "version": " V2.3.1"
            },
            {
              "status": "affected",
              "version": " V2.4"
            },
            {
              "status": "affected",
              "version": " V2.5"
            },
            {
              "status": "affected",
              "version": " V2.6"
            },
            {
              "status": "affected",
              "version": " and V2.7"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V3.0"
            },
            {
              "status": "affected",
              "version": " V3.0.2"
            },
            {
              "status": "affected",
              "version": " V3.0.2.1"
            },
            {
              "status": "affected",
              "version": " and V3.0.3"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager SaaS",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Versions before the maintenance on June 16"
            },
            {
              "status": "affected",
              "version": " 2024"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Missing authentication for critical function",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T05:44:18.590Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN65171386/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-33622",
    "datePublished": "2024-06-18T05:44:18.590Z",
    "dateReserved": "2024-05-22T00:24:00.288Z",
    "dateUpdated": "2024-11-21T15:37:25.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.