jvndb - jvndb-2024-013260

jvndb-2024-013260

Vulnerability from jvndb

Published

2024-11-22 10:59

Modified

2025-11-04 16:41

Summary

Multiple vulnerabilities in Edgecross Basic Software for Windows

Details

Edgecross Basic Software for Windows provided by Edgecross Consortium contains multiple vulnerabilities listed below. * Incorrect default permissions (CWE-276) - CVE-2024-4229 * External control of file name or path (CWE-73) - CVE-2024-4230 Edgecross Consortium reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU92857077/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-4229
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-4230
	Incorrect Default Permissions(CWE-276)	https://cwe.mitre.org/data/definitions/276.html
	External Control of File Name or Path(CWE-73)	https://cwe.mitre.org/data/definitions/73.html

Impacted products

Vendor

Product

	Edgecross Consortium	Edgecross Basic Software for Windows ECP-BS1-W
	Edgecross Consortium	Edgecross Basic Software for Developers ECP-BS1-W-D

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-013260.html",
  "dc:date": "2025-11-04T16:41+09:00",
  "dcterms:issued": "2024-11-22T10:59+09:00",
  "dcterms:modified": "2025-11-04T16:41+09:00",
  "description": "Edgecross Basic Software for Windows provided by Edgecross Consortium contains multiple vulnerabilities listed below.\r\n\r\n* Incorrect default permissions (CWE-276) - CVE-2024-4229\r\n* External control of file name or path (CWE-73) - CVE-2024-4230\r\n\r\nEdgecross Consortium reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-013260.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:misc:edgecross_ecp-bs1-w",
      "@product": "Edgecross Basic Software for Windows ECP-BS1-W",
      "@vendor": "Edgecross Consortium",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:edgecross_ecp-bs1-w-d",
      "@product": "Edgecross Basic Software for Developers ECP-BS1-W-D",
      "@vendor": "Edgecross Consortium",
      "@version": "2.2"
    }
  ],
  "sec:identifier": "JVNDB-2024-013260",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU92857077/index.html",
      "@id": "JVNVU#92857077",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-4229",
      "@id": "CVE-2024-4229",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-4230",
      "@id": "CVE-2024-4230",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/276.html",
      "@id": "CWE-276",
      "@title": "Incorrect Default Permissions(CWE-276)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/73.html",
      "@id": "CWE-73",
      "@title": "External Control of File Name or Path(CWE-73)"
    }
  ],
  "title": "Multiple vulnerabilities in Edgecross Basic Software for Windows"
}

CVE-2024-4229 (GCVE-0-2024-4229)

Vulnerability from cvelistv5

Published

2024-12-19 07:20

Modified

2024-12-19 16:38

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-276 - Incorrect Default Permissions

Summary

Incorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than a folder that only users with administrative privilege have permission to modify.

References

URL

Tags

	https://www.edgecross.org/client_info/EDGECROSS/view/userweb/ext/en/data-download/pdf/ECD-TE10-0003-01-EN.pdf	vendor-advisory
	https://jvn.jp/vu/JVNVU92857077/index.html	government-resource

Impacted products

Vendor

Product

Version

Edgecross Consortium

Edgecross Basic Software for Windows

Version: versions 1.00 and later

Edgecross Consortium

Edgecross Basic Software for Developers

Version: versions 1.00 and later

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-4229",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-19T16:27:51.352323Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-19T16:38:12.287Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Edgecross Basic Software for Windows",
          "vendor": "Edgecross Consortium",
          "versions": [
            {
              "status": "affected",
              "version": "versions 1.00 and later"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Edgecross Basic Software for Developers",
          "vendor": "Edgecross Consortium",
          "versions": [
            {
              "status": "affected",
              "version": "versions 1.00 and later"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than a folder that only users with administrative privilege have permission to modify."
            }
          ],
          "value": "Incorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than a folder that only users with administrative privilege have permission to modify."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Arbitrary Code Execution"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T07:20:54.952Z",
        "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "shortName": "Mitsubishi"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.edgecross.org/client_info/EDGECROSS/view/userweb/ext/en/data-download/pdf/ECD-TE10-0003-01-EN.pdf"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://jvn.jp/vu/JVNVU92857077/index.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
    "assignerShortName": "Mitsubishi",
    "cveId": "CVE-2024-4229",
    "datePublished": "2024-12-19T07:20:54.952Z",
    "dateReserved": "2024-04-26T08:56:44.357Z",
    "dateUpdated": "2024-12-19T16:38:12.287Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-4230 (GCVE-0-2024-4230)

Vulnerability from cvelistv5

Published

2024-12-19 07:23

Modified

2024-12-19 16:38

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-73 - External Control of File Name or Path

Summary

External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition.

References

URL

Tags

	https://www.edgecross.org/client_info/EDGECROSS/view/userweb/ext/en/data-download/pdf/ECD-TE10-0003-01-EN.pdf	vendor-advisory
	https://jvn.jp/vu/JVNVU92857077/index.html	government-resource

Impacted products

Vendor

Product

Version

Edgecross Consortium

Edgecross Basic Software for Windows

Version: versions 1.00 and later

Edgecross Consortium

Edgecross Basic Software for Developers

Version: versions 1.00 and later

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-4230",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-19T16:27:48.756311Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-19T16:38:06.221Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Edgecross Basic Software for Windows",
          "vendor": "Edgecross Consortium",
          "versions": [
            {
              "status": "affected",
              "version": "versions 1.00 and later"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Edgecross Basic Software for Developers",
          "vendor": "Edgecross Consortium",
          "versions": [
            {
              "status": "affected",
              "version": "versions 1.00 and later"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition."
            }
          ],
          "value": "External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Arbitrary Code Execution"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T07:23:38.732Z",
        "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "shortName": "Mitsubishi"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.edgecross.org/client_info/EDGECROSS/view/userweb/ext/en/data-download/pdf/ECD-TE10-0003-01-EN.pdf"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://jvn.jp/vu/JVNVU92857077/index.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
    "assignerShortName": "Mitsubishi",
    "cveId": "CVE-2024-4230",
    "datePublished": "2024-12-19T07:23:38.732Z",
    "dateReserved": "2024-04-26T08:56:48.119Z",
    "dateUpdated": "2024-12-19T16:38:06.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

jvndb-2024-013260

Vulnerability from jvndb

CVE-2024-4229 (GCVE-0-2024-4229)

Vulnerability from cvelistv5

CVE-2024-4230 (GCVE-0-2024-4230)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature