Vulnerability-Lookup

CVE-2024-33622 (GCVE-0-2024-33622)

Vulnerability from cvelistv5 – Published: 2024-06-18 05:44 – Updated: 2024-11-21 15:37

Summary

Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Missing authentication for critical function
CWE-306 - Missing Authentication for Critical Function

Assigner

jpcert

References

2 references

URL	Tags
https://www.fujitsu.com/jp/group/fsas/about/resou…
https://jvn.jp/en/jp/JVN65171386/

Impacted products

5 products

Vendor	Product	Version
Fsas Technologies Inc.	FUJITSU Business Application ID Link Manager II	Affected: V1.8 and earlier
Fsas Technologies Inc.	FUJITSU Software ID Link Manager	Affected: V2.0
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager	Affected: V2.3.0 Affected: V2.3.1 Affected: V2.4 Affected: V2.5 Affected: V2.6 Affected: and V2.7
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager	Affected: V3.0 Affected: V3.0.2 Affected: V3.0.2.1 Affected: and V3.0.3
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager SaaS	Affected: Versions before the maintenance on June 16 Affected: 2024

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-33622",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-01T16:30:50.447465Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-306",
                "description": "CWE-306 Missing Authentication for Critical Function",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T15:37:25.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:36:04.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN65171386/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FUJITSU Business Application ID Link Manager II",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V1.8 and earlier"
            }
          ]
        },
        {
          "product": "FUJITSU Software ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.3.0"
            },
            {
              "status": "affected",
              "version": " V2.3.1"
            },
            {
              "status": "affected",
              "version": " V2.4"
            },
            {
              "status": "affected",
              "version": " V2.5"
            },
            {
              "status": "affected",
              "version": " V2.6"
            },
            {
              "status": "affected",
              "version": " and V2.7"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V3.0"
            },
            {
              "status": "affected",
              "version": " V3.0.2"
            },
            {
              "status": "affected",
              "version": " V3.0.2.1"
            },
            {
              "status": "affected",
              "version": " and V3.0.3"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager SaaS",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Versions before the maintenance on June 16"
            },
            {
              "status": "affected",
              "version": " 2024"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Missing authentication for critical function",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T05:44:18.590Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN65171386/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-33622",
    "datePublished": "2024-06-18T05:44:18.590Z",
    "dateReserved": "2024-05-22T00:24:00.288Z",
    "dateUpdated": "2024-11-21T15:37:25.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-33622",
      "date": "2026-07-12",
      "epss": "0.00438",
      "percentile": "0.35336"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-33622\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-06-18T06:15:11.163\",\"lastModified\":\"2026-06-17T07:32:06.517\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.\"},{\"lang\":\"es\",\"value\":\"Falta autenticaci\u00f3n para una vulnerabilidad de funci\u00f3n cr\u00edtica en ID Link Manager y FUJITSU Software TIME CREATOR. Si se explota esta vulnerabilidad, un atacante remoto autenticado puede obtener informaci\u00f3n confidencial y/o la informaci\u00f3n almacenada en la base de datos puede ser alterada.\"}],\"affected\":[{\"source\":\"vultures@jpcert.or.jp\",\"affectedData\":[{\"vendor\":\"Fsas Technologies Inc.\",\"product\":\"FUJITSU Business Application ID Link Manager II\",\"versions\":[{\"version\":\"V1.8 and earlier\",\"status\":\"affected\"}]},{\"vendor\":\"Fsas Technologies Inc.\",\"product\":\"FUJITSU Software ID Link Manager\",\"versions\":[{\"version\":\"V2.0\",\"status\":\"affected\"}]},{\"vendor\":\"Fsas Technologies Inc.\",\"product\":\"FUJITSU Software TIME CREATOR ID Link Manager\",\"versions\":[{\"version\":\"V2.3.0\",\"status\":\"affected\"},{\"version\":\" V2.3.1\",\"status\":\"affected\"},{\"version\":\" V2.4\",\"status\":\"affected\"},{\"version\":\" V2.5\",\"status\":\"affected\"},{\"version\":\" V2.6\",\"status\":\"affected\"},{\"version\":\" and V2.7\",\"status\":\"affected\"}]},{\"vendor\":\"Fsas Technologies Inc.\",\"product\":\"FUJITSU Software TIME CREATOR ID Link Manager\",\"versions\":[{\"version\":\"V3.0\",\"status\":\"affected\"},{\"version\":\" V3.0.2\",\"status\":\"affected\"},{\"version\":\" V3.0.2.1\",\"status\":\"affected\"},{\"version\":\" and V3.0.3\",\"status\":\"affected\"}]},{\"vendor\":\"Fsas Technologies Inc.\",\"product\":\"FUJITSU Software TIME CREATOR ID Link Manager SaaS\",\"versions\":[{\"version\":\"Versions before the maintenance on June 16\",\"status\":\"affected\"},{\"version\":\" 2024\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-07-01T16:30:50.447465Z\",\"id\":\"CVE-2024-33622\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN65171386/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://jvn.jp/en/jp/JVN65171386/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T21:42:12+00:00",
      "cve": "CVE-2024-33622",
      "id": "CVE-2024-33622",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-33622",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-33622.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://jvn.jp/en/jp/JVN65171386/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T02:36:04.055Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-33622\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-01T16:30:50.447465Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306 Missing Authentication for Critical Function\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-01T16:31:01.345Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Business Application ID Link Manager II\", \"versions\": [{\"status\": \"affected\", \"version\": \"V1.8 and earlier\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software ID Link Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V2.0\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software TIME CREATOR ID Link Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V2.3.0\"}, {\"status\": \"affected\", \"version\": \" V2.3.1\"}, {\"status\": \"affected\", \"version\": \" V2.4\"}, {\"status\": \"affected\", \"version\": \" V2.5\"}, {\"status\": \"affected\", \"version\": \" V2.6\"}, {\"status\": \"affected\", \"version\": \" and V2.7\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software TIME CREATOR ID Link Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.0\"}, {\"status\": \"affected\", \"version\": \" V3.0.2\"}, {\"status\": \"affected\", \"version\": \" V3.0.2.1\"}, {\"status\": \"affected\", \"version\": \" and V3.0.3\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"FUJITSU Software TIME CREATOR ID Link Manager SaaS\", \"versions\": [{\"status\": \"affected\", \"version\": \"Versions before the maintenance on June 16\"}, {\"status\": \"affected\", \"version\": \" 2024\"}]}], \"references\": [{\"url\": \"https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html\"}, {\"url\": \"https://jvn.jp/en/jp/JVN65171386/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Missing authentication for critical function\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2024-06-18T05:44:18.590Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-33622\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-21T15:37:25.545Z\", \"dateReserved\": \"2024-05-22T00:24:00.288Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2024-06-18T05:44:18.590Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-33622

Vulnerability from fkie_nvd - Published: 2024-06-18 06:15 - Updated: 2026-06-17 07:32

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN65171386/
	vultures@jpcert.or.jp	https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html
	af854a3a-2127-422b-91ae-364da2661108	https://jvn.jp/en/jp/JVN65171386/
	af854a3a-2127-422b-91ae-364da2661108	https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "FUJITSU Business Application ID Link Manager II",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V1.8 and earlier"
            }
          ]
        },
        {
          "product": "FUJITSU Software ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V2.3.0"
            },
            {
              "status": "affected",
              "version": " V2.3.1"
            },
            {
              "status": "affected",
              "version": " V2.4"
            },
            {
              "status": "affected",
              "version": " V2.5"
            },
            {
              "status": "affected",
              "version": " V2.6"
            },
            {
              "status": "affected",
              "version": " and V2.7"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V3.0"
            },
            {
              "status": "affected",
              "version": " V3.0.2"
            },
            {
              "status": "affected",
              "version": " V3.0.2.1"
            },
            {
              "status": "affected",
              "version": " and V3.0.3"
            }
          ]
        },
        {
          "product": "FUJITSU Software TIME CREATOR ID Link Manager SaaS",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Versions before the maintenance on June 16"
            },
            {
              "status": "affected",
              "version": " 2024"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker."
    },
    {
      "lang": "es",
      "value": "Falta autenticaci\u00f3n para una vulnerabilidad de funci\u00f3n cr\u00edtica en ID Link Manager y FUJITSU Software TIME CREATOR. Si se explota esta vulnerabilidad, un atacante remoto autenticado puede obtener informaci\u00f3n confidencial y/o la informaci\u00f3n almacenada en la base de datos puede ser alterada."
    }
  ],
  "id": "CVE-2024-33622",
  "lastModified": "2026-06-17T07:32:06.517",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-33622",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-07-01T16:30:50.447465Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-06-18T06:15:11.163",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/jp/JVN65171386/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://jvn.jp/en/jp/JVN65171386/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-9VWW-2CQ4-Q8XH

Vulnerability from github – Published: 2024-06-18 06:30 – Updated: 2024-06-18 06:30

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-33622"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-18T06:15:11Z",
    "severity": null
  },
  "details": "Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.",
  "id": "GHSA-9vww-2cq4-q8xh",
  "modified": "2024-06-18T06:30:41Z",
  "published": "2024-06-18T06:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33622"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN65171386"
    },
    {
      "type": "WEB",
      "url": "https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

JVNDB-2024-000063

Vulnerability from jvndb - Published: 2024-06-18 13:43 - Updated:2024-06-18 13:43

Severity

8.6 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

Multiple vulnerabilities in ID Link Manager and FUJITSU Software TIME CREATOR

Details

ID Link Manager and FUJITSU Software TIME CREATOR provided by Fsas Technologies Inc. contain multiple vulnerabilities listed below. * Path Traversal (CWE-36) (CVE-2024-33620) * Missing Authentication (CWE-306) (CVE-2024-33622) * Information disclosure (CWE-204) (CVE-2024-34024) Christian Demko of WithSecure KK reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer Fsas Technologies Inc.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN65171386/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-33620
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-33622
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-34024
	Information Exposure(CWE-200)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Improper Authentication(CWE-287)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	Fsas Technologies Inc.	FUJITSU Business Application ID Link ManagerII
	Fsas Technologies Inc.	FUJITSU Software ID Link Manager
	Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000063.html",
  "dc:date": "2024-06-18T13:43+09:00",
  "dcterms:issued": "2024-06-18T13:43+09:00",
  "dcterms:modified": "2024-06-18T13:43+09:00",
  "description": "ID Link Manager and FUJITSU Software TIME CREATOR provided by Fsas Technologies Inc. contain multiple vulnerabilities listed below.\r\n\r\n* Path Traversal (CWE-36) (CVE-2024-33620)\r\n* Missing Authentication (CWE-306) (CVE-2024-33622)\r\n* Information disclosure (CWE-204) (CVE-2024-34024)\r\n\r\nChristian Demko of WithSecure KK reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer Fsas Technologies Inc.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000063.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:misc:fsas_technologies_fujitsu_business_application_id_link_manager2",
      "@product": "FUJITSU Business Application ID Link ManagerII",
      "@vendor": "Fsas Technologies Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:fsas_technologies_fujitsu_software_id_link_manager",
      "@product": "FUJITSU Software ID Link Manager",
      "@vendor": "Fsas Technologies Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:fsas_technologies_fujitsu_software_time_creator_id_link_manager",
      "@product": "FUJITSU Software TIME CREATOR ID Link Manager",
      "@vendor": "Fsas Technologies Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.6",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000063",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN65171386/index.html",
      "@id": "JVN#65171386",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-33620",
      "@id": "CVE-2024-33620",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-33622",
      "@id": "CVE-2024-33622",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-34024",
      "@id": "CVE-2024-34024",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-287",
      "@title": "Improper Authentication(CWE-287)"
    }
  ],
  "title": "Multiple vulnerabilities in ID Link Manager and FUJITSU Software TIME CREATOR"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-33622 (GCVE-0-2024-33622)

FKIE_CVE-2024-33622

GHSA-9VWW-2CQ4-Q8XH

JVNDB-2024-000063

Tags

Sightings

Nomenclature