{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2025-6558", "aliases": [], "title": "Chrome：脆弱性情報", "summary": "Google Chrome の 138.0.7204.157 より前のバージョンにおいて、ANGLE と GPU の入力検証が不十分であるため、リモートの攻撃者が細工した HTML ページを使ってサンドボックスから脱出できる可能性があります。", "risk": "攻撃者がサンドボックスから脱出できる可能性がある。", "product": "Chrome", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Chrome", "cvssVector": null, "affected": [ { "product": "Chrome", "range": ">= 138.0.7204.157 / < 138.0.7204.157" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-6558", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/427162086", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6558", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-07-15T18:12:36.848Z", "modifiedAt": "2026-10-01T01:35:11.329Z", "fetchedAt": "2026-10-24T08:41:36.963Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Chrome", "versions": [ { "version": "138.0.7204.157", "status": "affected", "lessThan": "138.0.7204.157", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-6558", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json", "fetchedAt": "2026-10-24T08:41:36.963Z", "publishedAt": "2025-07-15T18:12:36.848Z", "modifiedAt": "2026-10-01T01:35:11.329Z", "state": "published", "provider": "Chrome", "title": "", "descriptions": [ { "lang": "en", "value": "Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Google", "product": "Chrome", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "138.0.7204.157", "lessThan": "138.0.7204.157", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-20", "lang": "en", "description": "Insufficient validation of untrusted input", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/0" }, { "url": "https://issues.chromium.org/issues/427162086", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6558", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "http://seclists.org/fulldisclosure/2025/Aug/0", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "http://seclists.org/fulldisclosure/2025/Jul/37", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "http://seclists.org/fulldisclosure/2025/Jul/35", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" }, { "url": "http://seclists.org/fulldisclosure/2025/Jul/32", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/4" }, { "url": "http://seclists.org/fulldisclosure/2025/Jul/30", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/5" }, { "url": "http://www.openwall.com/lists/oss-security/2025/08/02/1", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/6" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/30/18", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"138.0.7204.157\",\"status\":\"affected\",\"lessThan\":\"138.0.7204.157\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Insufficient validation of untrusted input\",\"cweId\":\"CWE-20\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-6558:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558", "sourcePath": "retained:/originalText", "text": "Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-6558:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558", "modifiedAt": "2025-07-22T00:00:00.000Z", "fetchedAt": "2026-10-24T08:17:50.152Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-01T01:35:11.329Z", "fetchedAt": "2026-10-24T08:41:36.963Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-22T00:00:00.000Z", "fetchedAt": "2026-10-24T08:17:50.152Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Chromeに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T08:41:36.963Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "235fb0448bb2832db0438bea88cf4f6f47d007f83959b2b3dd5eaa1fc18116d5", "sourceModifiedAt": "2026-10-01T01:35:11.329Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Google Chrome の 138.0.7204.157 より前のバージョンにおいて、ANGLE と GPU の入力検証が不十分であるため、リモートの攻撃者が細工した HTML ページを使ってサンドボックスから脱出できる可能性があります。", "risk": "攻撃者がサンドボックスから脱出できる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "リモートの攻撃者が細工した HTML ページを表示させることができる環境。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json" ], "evidenceIds": [ "E1" ] }, { "text": "Google Chrome のバージョン 138.0.7204.157 より前のもの。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも138.0.7204.157で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Chrome」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-6558", "https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html", "https://issues.chromium.org/issues/427162086", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558", "https://nvd.nist.gov/vuln/detail/CVE-2025-6558" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-6558", "https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html", "https://issues.chromium.org/issues/427162086", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558", "https://nvd.nist.gov/vuln/detail/CVE-2025-6558" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-6558", "https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html", "https://issues.chromium.org/issues/427162086", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558", "https://nvd.nist.gov/vuln/detail/CVE-2025-6558" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-6558", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/427162086", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6558", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6558.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"138.0.7204.157\",\"status\":\"affected\",\"lessThan\":\"138.0.7204.157\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6558", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-6558\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-6558（Chrome）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの攻撃者が細工した HTML ページを表示させることができる環境。\n・Google Chrome のバージョン 138.0.7204.157 より前のもの。\n・公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも138.0.7204.157で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-6558", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T08:41:36.963Z", "lastSuccess": "2026-10-24T08:41:36.963Z", "sourceCheckedAt": "2026-10-24T08:41:36.963Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-53770", "aliases": [], "title": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition：コード実行", "summary": "オンプレミスの Microsoft SharePoint Server で信頼できないデータの逆シリアル化が行われると、未認可の攻撃者がネットワーク越しにコードを実行できる脆弱性です。Microsoft はこの脆弱性のエクスプロイトが実際に流通していることを確認しており、包括的な更新プログラムを準備・テスト中です。その間は本 CVE の文書に記載された緩和策を適用して保護してください。", "risk": "攻撃者がネットワーク越しにコードを実行できる可能性があります。", "product": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition", "category": "windows", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C", "affected": [ { "product": "Microsoft SharePoint Enterprise Server 2016", "range": ">= 16.0.0 / < 16.0.5513.1001（環境: x64-based Systems）" }, { "product": "Microsoft SharePoint Server 2019", "range": ">= 16.0.0 / < 16.0.10417.20037（環境: x64-based Systems）" }, { "product": "Microsoft SharePoint Server Subscription Edition", "range": ">= 16.0.0 / < 16.0.18526.20508（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-53770", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770", "label": "CISAが示す関連情報" }, { "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53770", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-07-20T01:06:33.607Z", "modifiedAt": "2026-08-04T03:55:52.588Z", "fetchedAt": "2026-10-24T04:46:08.215Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.5513.1001", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.10417.20037", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.18526.20508", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: x64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-53770", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "fetchedAt": "2026-10-24T04:46:08.215Z", "publishedAt": "2025-07-20T01:06:33.607Z", "modifiedAt": "2026-08-04T03:55:52.588Z", "state": "published", "provider": "microsoft", "title": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.\nMicrosoft is aware that an exploit for CVE-2025-53770 exists in the wild.\nMicrosoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016", "sourcePath": "/containers/cna/affected/0", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "16.0.0", "lessThan": "16.0.5513.1001", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server 2019", "sourcePath": "/containers/cna/affected/1", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "16.0.0", "lessThan": "16.0.10417.20037", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "16.0.0", "lessThan": "16.0.18526.20508", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-502", "lang": "en-US", "description": "CWE-502: Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770", "label": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://research.eye.security/sharepoint-under-siege/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" }, { "url": "https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/4" }, { "url": "https://x.com/Shadowserver/status/1946900837306868163", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/5" }, { "url": "https://github.com/kaizensecurity/CVE-2025-53770", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/6" }, { "url": "https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/7" }, { "url": "https://news.ycombinator.com/item?id=44629710", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/8" }, { "url": "https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/9" }, { "url": "https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/10" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Enterprise Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.5513.1001\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.10417.20037\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server Subscription Edition\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.18526.20508\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.\nMicrosoft is aware that an exploit for CVE-2025-53770 exists in the wild.\nMicrosoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-502: Deserialization of Untrusted Data\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-502\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-53770:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "sourcePath": "retained:/originalText", "text": "Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-53770:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "sourcePath": "retained:/sourceAction", "text": "Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "modifiedAt": "2025-07-20T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-04T03:55:52.588Z", "fetchedAt": "2026-10-24T04:46:08.215Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-20T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.", "sourceSummary": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Editionにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:46:08.215Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f82350f77b40760541f2ba05bf5847aa054c465d930210c7b79098cd811a4058", "sourceModifiedAt": "2026-08-04T03:55:52.588Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "オンプレミスの Microsoft SharePoint Server で信頼できないデータの逆シリアル化が行われると、未認可の攻撃者がネットワーク越しにコードを実行できる脆弱性です。Microsoft はこの脆弱性のエクスプロイトが実際に流通していることを確認しており、包括的な更新プログラムを準備・テスト中です。その間は本 CVE の文書に記載された緩和策を適用して保護してください。", "risk": "攻撃者がネットワーク越しにコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象はオンプレミスで稼働する Microsoft SharePoint Server で、信頼できないデータが逆シリアル化される状況です。攻撃者は未認可である必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Enterprise Server 2016。影響ありとして記載：16.0.0以上、16.0.5513.1001未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Server 2019。影響ありとして記載：16.0.0以上、16.0.10417.20037未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Server Subscription Edition。影響ありとして記載：16.0.0以上、16.0.18526.20508未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-53770", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770", "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "https://nvd.nist.gov/vuln/detail/CVE-2025-53770" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-53770", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770", "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "https://nvd.nist.gov/vuln/detail/CVE-2025-53770" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-53770", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770", "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "https://nvd.nist.gov/vuln/detail/CVE-2025-53770" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-53770", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770", "label": "CISAが示す関連情報" }, { "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53770", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.\nMicrosoft is aware that an exploit for CVE-2025-53770 exists in the wild.\nMicrosoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourceField": "/containers/cna/title", "excerpt": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Enterprise Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.5513.1001\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.10417.20037\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53770.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server Subscription Edition\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.18526.20508\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53770", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-53770\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-53770（Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象はオンプレミスで稼働する Microsoft SharePoint Server で、信頼できないデータが逆シリアル化される状況です。攻撃者は未認可である必要があります。\n・公式の対象表：Microsoft / Microsoft SharePoint Enterprise Server 2016。影響ありとして記載：16.0.0以上、16.0.5513.1001未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft SharePoint Server 2019。影響ありとして記載：16.0.0以上、16.0.10417.20037未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft SharePoint Server Subscription Edition。影響ありとして記載：16.0.0以上、16.0.18526.20508未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-53770", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:08.215Z", "lastSuccess": "2026-10-24T04:46:08.215Z", "sourceCheckedAt": "2026-10-24T04:46:08.215Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-25257", "aliases": [], "title": "FortiWeb：データベースへの不正操作", "summary": "FortiWeb 7.6.0 から 7.6.3、7.4.0 から 7.4.7、7.2.0 から 7.2.10、7.0.0 から 7.0.10 に存在する SQL インジェクション（CWE‑89）脆弱性により、認証されていない攻撃者が細工した HTTP または HTTPS リクエストを送ることで、不正な SQL コードやコマンドを実行できる。", "risk": "不正な SQL コードやコマンドが実行される可能性がある。", "product": "FortiWeb", "category": "other", "component": "package", "severity": "critical", "cvss": 9.6, "cvssVersion": "3.1", "cvssSource": "fortinet", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C", "affected": [ { "product": "FortiWeb", "range": ">= 7.6.0 / <= 7.6.3" }, { "product": "FortiWeb", "range": ">= 7.4.0 / <= 7.4.7" }, { "product": "FortiWeb", "range": ">= 7.2.0 / <= 7.2.10" }, { "product": "FortiWeb", "range": ">= 7.0.0 / <= 7.0.10" } ], "fixed": [], "steps": [ "FortiWeb をバージョン 7.6.4 以上にアップグレードする。", "FortiWeb をバージョン 7.4.8 以上にアップグレードする。", "FortiWeb をバージョン 7.2.11 以上にアップグレードする。", "FortiWeb をバージョン 7.0.11 以上にアップグレードする。", "「CVE-2025-25257」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-25257", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25257", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-07-17T15:10:04.532Z", "modifiedAt": "2026-02-26T17:50:29.556Z", "fetchedAt": "2026-10-24T04:46:09.014Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Fortinet", "product": "FortiWeb", "cpes": [ "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.6.0", "lessThanOrEqual": "7.6.3", "status": "affected" }, { "versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.7", "status": "affected" }, { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.10", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.10", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-25257", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "fetchedAt": "2026-10-24T04:46:09.014Z", "publishedAt": "2025-07-17T15:10:04.532Z", "modifiedAt": "2026-02-26T17:50:29.556Z", "state": "published", "provider": "fortinet", "title": "", "descriptions": [ { "lang": "en", "value": "An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Fortinet", "product": "FortiWeb", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.6.0", "lessThanOrEqual": "7.6.3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.4.0", "lessThanOrEqual": "7.4.7", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.2.0", "lessThanOrEqual": "7.2.10", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "7.0.0", "lessThanOrEqual": "7.0.10", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to FortiWeb version 7.6.4 or above\nUpgrade to FortiWeb version 7.4.8 or above\nUpgrade to FortiWeb version 7.2.11 or above\nUpgrade to FortiWeb version 7.0.11 or above", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "Execute unauthorized code or commands", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C", "baseScore": 9.6, "baseSeverity": "CRITICAL", "provider": "fortinet", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151", "label": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151", "tags": [], "provider": "fortinet", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/0xbigshaq/CVE-2025-25257", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.exploit-db.com/exploits/52473", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://packetstorm.news/files/id/210193/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiWeb\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.6.0\",\"lessThanOrEqual\":\"7.6.3\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.4.0\",\"lessThanOrEqual\":\"7.4.7\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.10\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.10\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Upgrade to FortiWeb version 7.6.4 or above\nUpgrade to FortiWeb version 7.4.8 or above\nUpgrade to FortiWeb version 7.2.11 or above\nUpgrade to FortiWeb version 7.0.11 or above", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-89\",\"description\":\"Execute unauthorized code or commands\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-25257:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "sourcePath": "retained:/originalText", "text": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-25257:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "modifiedAt": "2025-07-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T17:50:29.556Z", "fetchedAt": "2026-10-24T04:46:09.014Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "FortiWebにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:46:09.014Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3f67e399a1c18175b7dfb6105f5d28570b6cd559396b7c197ecb58ec9b8a0760", "sourceModifiedAt": "2026-02-26T17:50:29.556Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "FortiWeb 7.6.0 から 7.6.3、7.4.0 から 7.4.7、7.2.0 から 7.2.10、7.0.0 から 7.0.10 に存在する SQL インジェクション（CWE‑89）脆弱性により、認証されていない攻撃者が細工した HTTP または HTTPS リクエストを送ることで、不正な SQL コードやコマンドを実行できる。", "risk": "不正な SQL コードやコマンドが実行される可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "認証されていない攻撃者が細工した HTTP または HTTPS リクエストを送信できることが前提条件となる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Fortinet / FortiWeb。影響ありとして記載：7.6.0以上、7.6.3以下。影響ありとして記載：7.4.0以上、7.4.7以下。影響ありとして記載：7.2.0以上、7.2.10以下。影響ありとして記載：7.0.0以上、7.0.10以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json" ], "evidenceIds": [ "E3" ] }, { "text": "「FortiWeb」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-25257", "https://fortiguard.fortinet.com/psirt/FG-IR-25-151", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "https://nvd.nist.gov/vuln/detail/CVE-2025-25257" ] } ], "actions": [ { "text": "FortiWeb をバージョン 7.6.4 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiWeb をバージョン 7.4.8 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiWeb をバージョン 7.2.11 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiWeb をバージョン 7.0.11 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2025-25257」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-25257", "https://fortiguard.fortinet.com/psirt/FG-IR-25-151", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "https://nvd.nist.gov/vuln/detail/CVE-2025-25257" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-25257", "https://fortiguard.fortinet.com/psirt/FG-IR-25-151", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "https://nvd.nist.gov/vuln/detail/CVE-2025-25257" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-25257", "https://fortiguard.fortinet.com/psirt/FG-IR-25-151", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "https://nvd.nist.gov/vuln/detail/CVE-2025-25257" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-25257", "https://fortiguard.fortinet.com/psirt/FG-IR-25-151", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "https://nvd.nist.gov/vuln/detail/CVE-2025-25257" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-25257", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25257", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "sourceField": "retained:/originalText", "excerpt": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiWeb\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.6.0\",\"lessThanOrEqual\":\"7.6.3\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.4.0\",\"lessThanOrEqual\":\"7.4.7\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.10\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.10\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Upgrade to FortiWeb version 7.6.4 or above\nUpgrade to FortiWeb version 7.4.8 or above\nUpgrade to FortiWeb version 7.2.11 or above\nUpgrade to FortiWeb version 7.0.11 or above", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-25257\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-25257（FortiWeb）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者が細工した HTTP または HTTPS リクエストを送信できることが前提条件となる。\n・公式の対象表：Fortinet / FortiWeb。影響ありとして記載：7.6.0以上、7.6.3以下。影響ありとして記載：7.4.0以上、7.4.7以下。影響ありとして記載：7.2.0以上、7.2.10以下。影響ありとして記載：7.0.0以上、7.0.10以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-25257", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:09.014Z", "lastSuccess": "2026-10-24T04:46:09.014Z", "sourceCheckedAt": "2026-10-24T04:46:09.014Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-47812", "aliases": [], "title": "Wing FTP Server：コード実行", "summary": "Wing FTP Server の 7.4.4 未満のバージョンでは、ユーザーおよび管理者用の Web インターフェイスが '\\0' バイトを正しく処理できず、ユーザーセッションファイルに任意の Lua コードを注入できてしまいます。このコードは FTP サービス（既定では root または SYSTEM 権限）で実行され、リモートからサーバー全体を乗っ取ることが可能になるリモートコード実行脆弱性です。また、匿名 FTP アカウントからも悪用できます。", "risk": "攻撃者は任意のシステムコマンドを FTP サービスの権限（root または SYSTEM）で実行でき、サーバー全体が侵害される可能性があります。", "product": "Wing FTP Server", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Wing FTP Server", "range": "< 7.4.4" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-47812", "label": "CVE公式レコード" }, { "url": "https://www.wftpserver.com/", "label": "CVE掲載の参考情報" }, { "url": "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "label": "CVE掲載の参考情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server", "label": "CVE掲載の参考情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server", "label": "CVE掲載の参考情報" }, { "url": "https://www.wftpserver.com/serverhistory.htm", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47812", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-07-10T00:00:00.000Z", "modifiedAt": "2026-02-26T17:50:49.802Z", "fetchedAt": "2026-10-24T04:46:16.491Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Wing FTP Server", "vendor": "wftpserver", "versions": [ { "lessThan": "7.4.4", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-47812", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json", "fetchedAt": "2026-10-24T04:46:16.491Z", "publishedAt": "2025-07-10T00:00:00.000Z", "modifiedAt": "2026-02-26T17:50:49.802Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "wftpserver", "product": "Wing FTP Server", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "7.4.4", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-158", "lang": "en", "description": "CWE-158 Improper Neutralization of Null Byte or NUL Character", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wftpserver.com/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/2" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/3" }, { "url": "https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47812", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Wing FTP Server\",\"vendor\":\"wftpserver\",\"versions\":[{\"lessThan\":\"7.4.4\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-158\",\"description\":\"CWE-158 Improper Neutralization of Null Byte or NUL Character\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-47812:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "sourcePath": "retained:/originalText", "text": "Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-47812:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "modifiedAt": "2025-07-14T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T17:50:49.802Z", "fetchedAt": "2026-10-24T04:46:16.491Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-14T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Wing FTP Serverにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:46:16.491Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d78074a23bd4567cfa207f36fac4329afd82b48dc88257d422169395a05d94ca", "sourceModifiedAt": "2026-02-26T17:50:49.802Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Wing FTP Server の 7.4.4 未満のバージョンでは、ユーザーおよび管理者用の Web インターフェイスが '\\0' バイトを正しく処理できず、ユーザーセッションファイルに任意の Lua コードを注入できてしまいます。このコードは FTP サービス（既定では root または SYSTEM 権限）で実行され、リモートからサーバー全体を乗っ取ることが可能になるリモートコード実行脆弱性です。また、匿名 FTP アカウントからも悪用できます。", "risk": "攻撃者は任意のシステムコマンドを FTP サービスの権限（root または SYSTEM）で実行でき、サーバー全体が侵害される可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は Wing FTP Server の 7.4.4 未満のバージョンで、ユーザーおよび管理者用 Web インターフェイスが '\\0' バイトを誤処理する設定が存在すること、かつ FTP サービスが root または SYSTEM 権限で動作していること、さらに匿名 FTP アカウントが利用可能であることが条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：wftpserver / Wing FTP Server。影響ありとして記載：7.4.4未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Wing FTP Server」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-47812", "https://www.wftpserver.com/", "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server", "https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "https://www.wftpserver.com/serverhistory.htm", "https://nvd.nist.gov/vuln/detail/CVE-2025-47812" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-47812", "https://www.wftpserver.com/", "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server", "https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "https://www.wftpserver.com/serverhistory.htm", "https://nvd.nist.gov/vuln/detail/CVE-2025-47812" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-47812", "https://www.wftpserver.com/", "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server", "https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "https://www.wftpserver.com/serverhistory.htm", "https://nvd.nist.gov/vuln/detail/CVE-2025-47812" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-47812", "label": "CVE公式レコード" }, { "url": "https://www.wftpserver.com/", "label": "CVE掲載の参考情報" }, { "url": "https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/", "label": "CVE掲載の参考情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server", "label": "CVE掲載の参考情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server", "label": "CVE掲載の参考情報" }, { "url": "https://www.wftpserver.com/serverhistory.htm", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47812", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47812.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Wing FTP Server\",\"vendor\":\"wftpserver\",\"versions\":[{\"lessThan\":\"7.4.4\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-47812\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-47812（Wing FTP Server）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Wing FTP Server の 7.4.4 未満のバージョンで、ユーザーおよび管理者用 Web インターフェイスが '\\0' バイトを誤処理する設定が存在すること、かつ FTP サービスが root または SYSTEM 権限で動作していること、さらに匿名 FTP アカウントが利用可能であることが条件です。\n・公式の対象表：wftpserver / Wing FTP Server。影響ありとして記載：7.4.4未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-47812", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:16.491Z", "lastSuccess": "2026-10-24T04:46:16.491Z", "sourceCheckedAt": "2026-10-24T04:46:16.491Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-5777", "aliases": [], "title": "ADC / Gateway：脆弱性情報", "summary": "NetScalerがGateway（VPN仮想サーバ、ICA Proxy、CVPN、RDP Proxy）またはAAA仮想サーバとして構成されている場合、入力検証が不十分でメモリのオーバーリードが発生します。", "risk": "メモリのオーバーリードが発生する可能性があります。", "product": "ADC / Gateway", "category": "other", "component": "package", "severity": "critical", "cvss": 9.3, "cvssVersion": "4.0", "cvssSource": "Citrix", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "affected": [ { "product": "ADC", "range": ">= 14.1 / < 43.56" }, { "product": "ADC", "range": ">= 13.1 / < 58.32" }, { "product": "Gateway", "range": ">= 14.1 / < 43.56" }, { "product": "Gateway", "range": ">= 13.1 / < 58.32" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "label": "CVE：Citrix" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-5777", "label": "CVE公式レコード" }, { "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5777", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-06-17T12:29:34.506Z", "modifiedAt": "2026-10-07T17:58:25.623Z", "fetchedAt": "2026-10-24T04:46:22.578Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server", "sourceTitle": "NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "ADC", "vendor": "NetScaler", "versions": [ { "lessThan": "43.56", "status": "affected", "version": "14.1", "versionType": "patch" }, { "lessThan": "58.32", "status": "affected", "version": "13.1", "versionType": "patch" } ] }, { "defaultStatus": "unaffected", "product": "Gateway", "vendor": "NetScaler", "versions": [ { "lessThan": "43.56", "status": "affected", "version": "14.1", "versionType": "patch" }, { "lessThan": "58.32", "status": "affected", "version": "13.1", "versionType": "patch" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-5777", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "fetchedAt": "2026-10-24T04:46:22.578Z", "publishedAt": "2025-06-17T12:29:34.506Z", "modifiedAt": "2026-10-07T17:58:25.623Z", "state": "published", "provider": "Citrix", "title": "NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread", "descriptions": [ { "lang": "en", "value": "Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "NetScaler", "product": "ADC", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "14.1", "lessThan": "43.56", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "13.1", "lessThan": "58.32", "versionType": "patch", "status": "affected" } ] }, { "vendor": "NetScaler", "product": "Gateway", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "14.1", "lessThan": "43.56", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "13.1", "lessThan": "58.32", "versionType": "patch", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "Citrix", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420", "label": "Citrix", "tags": [], "provider": "Citrix", "sourcePath": "/containers/cna/references/0" }, { "url": "https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71", "label": "CISA-ADP", "tags": [ "third-party-advisory", "technical-description", "signature" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/", "label": "CISA-ADP", "tags": [ "media-coverage" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5777", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" }, { "url": "https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/4" }, { "url": "https://citrixbleed.com/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"ADC\",\"vendor\":\"NetScaler\",\"versions\":[{\"lessThan\":\"43.56\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"58.32\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Gateway\",\"vendor\":\"NetScaler\",\"versions\":[{\"lessThan\":\"43.56\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"58.32\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-125\",\"description\":\"CWE-125 Out-of-bounds Read\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"attackVector\":\"NETWORK\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"HIGH\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-5777:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "sourcePath": "retained:/originalText", "text": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-5777:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "modifiedAt": "2025-07-10T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-07T17:58:25.623Z", "fetchedAt": "2026-10-24T04:46:22.578Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-10T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "ADC / Gatewayに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:46:22.578Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "2bc0c9da7a0c218917eeda56292c660a84a46be15a26dc5b2e8a2faf26ca3e9a", "sourceModifiedAt": "2026-10-07T17:58:25.623Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "NetScalerがGateway（VPN仮想サーバ、ICA Proxy、CVPN、RDP Proxy）またはAAA仮想サーバとして構成されている場合、入力検証が不十分でメモリのオーバーリードが発生します。", "risk": "メモリのオーバーリードが発生する可能性があります。", "summaryEvidenceIds": [ "E1", "E2", "E3" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "NetScaler ADCおよびGatewayが、Gateway（VPN仮想サーバ、ICA Proxy、CVPN、RDP Proxy）またはAAA仮想サーバとして設定されている場合に影響します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777" ], "evidenceIds": [ "E1", "E2", "E3" ] }, { "text": "公式の対象表：NetScaler / ADC。影響ありとして記載：14.1以上、43.56未満。影響ありとして記載：13.1以上、58.32未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：NetScaler / Gateway。影響ありとして記載：14.1以上、43.56未満。影響ありとして記載：13.1以上、58.32未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json" ], "evidenceIds": [ "E4" ] }, { "text": "「ADC / Gateway」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-5777", "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "https://nvd.nist.gov/vuln/detail/CVE-2025-5777" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-5777", "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "https://nvd.nist.gov/vuln/detail/CVE-2025-5777" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-5777", "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "https://nvd.nist.gov/vuln/detail/CVE-2025-5777" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "label": "CVE：Citrix" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-5777", "label": "CVE公式レコード" }, { "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5777", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "sourceField": "retained:/originalText", "excerpt": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "sourceField": "/containers/cna/title", "excerpt": "NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread", "language": null }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"ADC\",\"vendor\":\"NetScaler\",\"versions\":[{\"lessThan\":\"43.56\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"58.32\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5777.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Gateway\",\"vendor\":\"NetScaler\",\"versions\":[{\"lessThan\":\"43.56\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"58.32\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-5777\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-5777（ADC / Gateway）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・NetScaler ADCおよびGatewayが、Gateway（VPN仮想サーバ、ICA Proxy、CVPN、RDP Proxy）またはAAA仮想サーバとして設定されている場合に影響します。\n・公式の対象表：NetScaler / ADC。影響ありとして記載：14.1以上、43.56未満。影響ありとして記載：13.1以上、58.32未満。\n・公式の対象表：NetScaler / Gateway。影響ありとして記載：14.1以上、43.56未満。影響ありとして記載：13.1以上、58.32未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-5777", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:22.578Z", "lastSuccess": "2026-10-24T04:46:22.578Z", "sourceCheckedAt": "2026-10-24T04:46:22.578Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2014-3931", "aliases": [], "title": "n/a：脆弱性情報", "summary": "MRLG（Multi‑Router Looking Glass）の fastping.c がバージョン5.5.0 未満に存在する場合、リモートの攻撃者が任意のメモリ書き込みとメモリ破損を引き起こすことができる。", "risk": "任意のメモリ書き込みとメモリ破損が発生し、システムが不安定になる可能性がある。", "product": "Looking Glass Multi-Router Looking Glass (MRLG)", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2014-3931", "label": "CVE公式レコード" }, { "url": "http://mrlg.op-sec.us/", "label": "CVE掲載の参考情報" }, { "url": "http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt", "label": "CVE掲載の参考情報" }, { "url": "https://hackerone.com/reports/16330", "label": "CVE掲載の参考情報" }, { "url": "https://mrlg.op-sec.us/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3931", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2017-03-31T15:00:00.000Z", "modifiedAt": "2025-10-21T23:55:43.153Z", "fetchedAt": "2026-10-24T08:16:25.185Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2014-3931", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json", "fetchedAt": "2026-10-24T08:16:25.185Z", "publishedAt": "2017-03-31T15:00:00.000Z", "modifiedAt": "2025-10-21T23:55:43.153Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://mrlg.op-sec.us/", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://hackerone.com/reports/16330", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3931", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2014-3931:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "sourcePath": "retained:/originalText", "text": "Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2014-3931:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "modifiedAt": "2025-07-07T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:55:43.153Z", "fetchedAt": "2026-10-24T08:16:25.185Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-07T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T08:16:25.185Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "bbeb5aedaf1e9dd0ed7973a4b99d2af1d141c9ac4ec51b9c05791b22732b67e7", "sourceModifiedAt": "2025-10-21T23:55:43.153Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "MRLG（Multi‑Router Looking Glass）の fastping.c がバージョン5.5.0 未満に存在する場合、リモートの攻撃者が任意のメモリ書き込みとメモリ破損を引き起こすことができる。", "risk": "任意のメモリ書き込みとメモリ破損が発生し、システムが不安定になる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "リモートの攻撃者が、バージョン5.5.0 未満の MRLG（Multi‑Router Looking Glass）に含まれる fastping.c を利用できる環境。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Looking Glass Multi-Router Looking Glass (MRLG)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2014-3931", "http://mrlg.op-sec.us/", "http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt", "https://hackerone.com/reports/16330", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "https://mrlg.op-sec.us/", "https://nvd.nist.gov/vuln/detail/CVE-2014-3931" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2014-3931", "http://mrlg.op-sec.us/", "http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt", "https://hackerone.com/reports/16330", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "https://mrlg.op-sec.us/", "https://nvd.nist.gov/vuln/detail/CVE-2014-3931" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2014-3931", "http://mrlg.op-sec.us/", "http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt", "https://hackerone.com/reports/16330", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "https://mrlg.op-sec.us/", "https://nvd.nist.gov/vuln/detail/CVE-2014-3931" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2014-3931", "label": "CVE公式レコード" }, { "url": "http://mrlg.op-sec.us/", "label": "CVE掲載の参考情報" }, { "url": "http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt", "label": "CVE掲載の参考情報" }, { "url": "https://hackerone.com/reports/16330", "label": "CVE掲載の参考情報" }, { "url": "https://mrlg.op-sec.us/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3931", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "sourceField": "retained:/originalText", "excerpt": "Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/3xxx/CVE-2014-3931.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-3931", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2014-3931\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2014-3931（Looking Glass Multi-Router Looking Glass (MRLG)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの攻撃者が、バージョン5.5.0 未満の MRLG（Multi‑Router Looking Glass）に含まれる fastping.c を利用できる環境。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2014-3931", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T08:16:25.185Z", "lastSuccess": "2026-10-24T08:16:25.185Z", "sourceCheckedAt": "2026-10-24T08:16:25.185Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2016-10033", "aliases": [], "title": "n/a：コード実行", "summary": "PHPMailer のバージョン 5.2.18 未満にある isMail トランスポートの mailSend 関数は、リモートの攻撃者が Sender プロパティにバックスラッシュと二重引用符（\\\"）を含めた細工を行うことで、mail コマンドに余分なパラメータを渡し、任意のコードを実行させる可能性があります。", "risk": "この脆弱性が悪用されると、アプリケーションの権限で任意のコードが実行され、失敗した攻撃試行はサービス拒否（DoS）状態を引き起こす可能性があります。", "product": "PHP PHPMailer", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2016-10033", "label": "CVE公式レコード" }, { "url": "http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.drupal.org/psa-2016-004", "label": "CVE掲載の参考情報" }, { "url": "https://www.exploit-db.com/exploits/42221/", "label": "42221" }, { "url": "https://www.exploit-db.com/exploits/40969/", "label": "40969" }, { "url": "https://www.exploit-db.com/exploits/41962/", "label": "41962" }, { "url": "https://www.exploit-db.com/exploits/40968/", "label": "40968" }, { "url": "https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18", "label": "CISAが示す関連情報" }, { "url": "http://www.securityfocus.com/archive/1/539963/100/0/threaded", "label": "20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]" }, { "url": "https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/advisories/GHSA-5f37-gxvh-23v6", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10033", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2016-12-30T19:00:00.000Z", "modifiedAt": "2025-10-21T23:55:47.202Z", "fetchedAt": "2026-10-24T04:46:25.135Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2016-10033", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json", "fetchedAt": "2026-10-24T04:46:25.135Z", "publishedAt": "2016-12-30T19:00:00.000Z", "modifiedAt": "2025-10-21T23:55:47.202Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.drupal.org/psa-2016-004", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.exploit-db.com/exploits/42221/", "label": "42221", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.exploit-db.com/exploits/40969/", "label": "40969", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://www.exploit-db.com/exploits/41962/", "label": "41962", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://www.exploit-db.com/exploits/40968/", "label": "40968", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "http://www.securityfocus.com/archive/1/539963/100/0/threaded", "label": "20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "https://www.exploit-db.com/exploits/40974/", "label": "40974", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "https://www.exploit-db.com/exploits/40986/", "label": "40986", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/12" }, { "url": "https://www.exploit-db.com/exploits/40970/", "label": "40970", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/13" }, { "url": "http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/14" }, { "url": "https://www.exploit-db.com/exploits/41996/", "label": "41996", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/15" }, { "url": "http://seclists.org/fulldisclosure/2016/Dec/78", "label": "20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]", "tags": [ "mailing-list", "x_refsource_FULLDISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/16" }, { "url": "http://www.securityfocus.com/bid/95108", "label": "95108", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/17" }, { "url": "http://www.securitytracker.com/id/1037533", "label": "1037533", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/18" }, { "url": "https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/19" }, { "url": "https://www.exploit-db.com/exploits/42024/", "label": "42024", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/20" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2016-10033:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "sourcePath": "retained:/originalText", "text": "PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2016-10033:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "modifiedAt": "2025-07-07T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:55:47.202Z", "fetchedAt": "2026-10-24T04:46:25.135Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-07T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:46:25.135Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "70776f8b4fec23f8370b83cee0e18fd76aebad99e35e6a3efd5bb0b3bb50fba1", "sourceModifiedAt": "2025-10-21T23:55:47.202Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHPMailer のバージョン 5.2.18 未満にある isMail トランスポートの mailSend 関数は、リモートの攻撃者が Sender プロパティにバックスラッシュと二重引用符（\\\"）を含めた細工を行うことで、mail コマンドに余分なパラメータを渡し、任意のコードを実行させる可能性があります。", "risk": "この脆弱性が悪用されると、アプリケーションの権限で任意のコードが実行され、失敗した攻撃試行はサービス拒否（DoS）状態を引き起こす可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "PHPMailer のバージョンが 5.2.18 未満で、isMail トランスポートの mailSend 関数が使用されている環境。攻撃者は Sender プロパティに \\\" を含む細工された文字列を送信できる必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json" ], "evidenceIds": [ "E3" ] }, { "text": "「PHP PHPMailer」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2016-10033", "http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html", "https://www.drupal.org/psa-2016-004", "https://www.exploit-db.com/exploits/42221/", "https://www.exploit-db.com/exploits/40969/", "https://www.exploit-db.com/exploits/41962/", "https://www.exploit-db.com/exploits/40968/", "https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html", "https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18", "http://www.securityfocus.com/archive/1/539963/100/0/threaded", "https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "https://github.com/advisories/GHSA-5f37-gxvh-23v6", "https://nvd.nist.gov/vuln/detail/CVE-2016-10033" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2016-10033", "http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html", "https://www.drupal.org/psa-2016-004", "https://www.exploit-db.com/exploits/42221/", "https://www.exploit-db.com/exploits/40969/", "https://www.exploit-db.com/exploits/41962/", "https://www.exploit-db.com/exploits/40968/", "https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html", "https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18", "http://www.securityfocus.com/archive/1/539963/100/0/threaded", "https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "https://github.com/advisories/GHSA-5f37-gxvh-23v6", "https://nvd.nist.gov/vuln/detail/CVE-2016-10033" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2016-10033", "http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html", "https://www.drupal.org/psa-2016-004", "https://www.exploit-db.com/exploits/42221/", "https://www.exploit-db.com/exploits/40969/", "https://www.exploit-db.com/exploits/41962/", "https://www.exploit-db.com/exploits/40968/", "https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html", "https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18", "http://www.securityfocus.com/archive/1/539963/100/0/threaded", "https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "https://github.com/advisories/GHSA-5f37-gxvh-23v6", "https://nvd.nist.gov/vuln/detail/CVE-2016-10033" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2016-10033", "label": "CVE公式レコード" }, { "url": "http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.drupal.org/psa-2016-004", "label": "CVE掲載の参考情報" }, { "url": "https://www.exploit-db.com/exploits/42221/", "label": "42221" }, { "url": "https://www.exploit-db.com/exploits/40969/", "label": "40969" }, { "url": "https://www.exploit-db.com/exploits/41962/", "label": "41962" }, { "url": "https://www.exploit-db.com/exploits/40968/", "label": "40968" }, { "url": "https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18", "label": "CISAが示す関連情報" }, { "url": "http://www.securityfocus.com/archive/1/539963/100/0/threaded", "label": "20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]" }, { "url": "https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/advisories/GHSA-5f37-gxvh-23v6", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10033", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "sourceField": "retained:/originalText", "excerpt": "PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/10xxx/CVE-2016-10033.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2016-10033\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2016-10033（PHP PHPMailer）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHPMailer のバージョンが 5.2.18 未満で、isMail トランスポートの mailSend 関数が使用されている環境。攻撃者は Sender プロパティに \\\" を含む細工された文字列を送信できる必要があります。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2016-10033", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:25.135Z", "lastSuccess": "2026-10-24T04:46:25.135Z", "sourceCheckedAt": "2026-10-24T04:46:25.135Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" }, { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2019-5418", "aliases": [], "title": "https://github.com/rails/rails：脆弱性情報", "summary": "Action View（バージョン 5.2.2.1 未満、5.1.6.2 未満、5.0.7.2 未満、4.2.11.1 未満、または v3）に対し、特別に細工した Accept ヘッダーを送信すると、対象サーバーの任意のファイルがレンダリングされ、ファイル内容が外部に漏洩するファイル内容開示脆弱性があります。", "risk": "攻撃者が細工した Accept ヘッダーを利用すると、サーバー上の任意のファイル内容が外部に公開される可能性があります。", "product": "https://github.com/rails/rails", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "hackerone", "cvssVector": null, "affected": [ { "product": "https://github.com/rails/rails", "range": "5.2.2.1" }, { "product": "https://github.com/rails/rails", "range": "5.1.6.2" }, { "product": "https://github.com/rails/rails", "range": "5.0.7.2" }, { "product": "https://github.com/rails/rails", "range": "4.2.11.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json", "label": "CVE：hackerone" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418", "label": "CVE公式レコード" }, { "url": "https://www.exploit-db.com/exploits/46585/", "label": "46585" }, { "url": "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html", "label": "CVE掲載の参考情報" }, { "url": "http://www.openwall.com/lists/oss-security/2019/03/22/1", "label": "[oss-security] 20190322 [CVE-2019-5418] Amendment: Possible Remote Code Execution Exploit in Action View" }, { "url": "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "label": "CVE掲載の参考情報" }, { "url": "https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q", "label": "CVE掲載の参考情報" }, { "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html", "label": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1739-1] rails security update" }, { "url": "https://access.redhat.com/errata/RHSA-2019:0796", "label": "RHSA-2019:0796" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html", "label": "openSUSE-SU-2019:1344" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/", "label": "FEDORA-2019-1cfe24db5c" }, { "url": "https://access.redhat.com/errata/RHSA-2019:1149", "label": "RHSA-2019:1149" }, { "url": "https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2019-03-27T13:38:58.000Z", "modifiedAt": "2025-10-21T23:45:41.038Z", "fetchedAt": "2026-10-24T08:31:09.312Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "https://github.com/rails/rails", "vendor": "Rails", "versions": [ { "status": "affected", "version": "5.2.2.1" }, { "status": "affected", "version": "5.1.6.2" }, { "status": "affected", "version": "5.0.7.2" }, { "status": "affected", "version": "4.2.11.1" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2019-5418", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json", "fetchedAt": "2026-10-24T08:31:09.312Z", "publishedAt": "2019-03-27T13:38:58.000Z", "modifiedAt": "2025-10-21T23:45:41.038Z", "state": "published", "provider": "hackerone", "title": "", "descriptions": [ { "lang": "en", "value": "There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Rails", "product": "https://github.com/rails/rails", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "5.2.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "5.1.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "5.0.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "4.2.11.1", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "Path Traversal (CWE-22)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.exploit-db.com/exploits/46585/", "label": "46585", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://www.openwall.com/lists/oss-security/2019/03/22/1", "label": "[oss-security] 20190322 [CVE-2019-5418] Amendment: Possible Remote Code Execution Exploit in Action View", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html", "label": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1739-1] rails security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://access.redhat.com/errata/RHSA-2019:0796", "label": "RHSA-2019:0796", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html", "label": "openSUSE-SU-2019:1344", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/", "label": "FEDORA-2019-1cfe24db5c", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "https://access.redhat.com/errata/RHSA-2019:1149", "label": "RHSA-2019:1149", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "https://access.redhat.com/errata/RHSA-2019:1147", "label": "RHSA-2019:1147", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "https://access.redhat.com/errata/RHSA-2019:1289", "label": "RHSA-2019:1289", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "label": "CISA-ADP", "tags": [], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5418", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"https://github.com/rails/rails\",\"vendor\":\"Rails\",\"versions\":[{\"status\":\"affected\",\"version\":\"5.2.2.1\"},{\"status\":\"affected\",\"version\":\"5.1.6.2\"},{\"status\":\"affected\",\"version\":\"5.0.7.2\"},{\"status\":\"affected\",\"version\":\"4.2.11.1\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-22\",\"description\":\"Path Traversal (CWE-22)\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2019-5418:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "sourcePath": "retained:/originalText", "text": "Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2019-5418:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "modifiedAt": "2025-07-07T00:00:00.000Z", "fetchedAt": "2026-10-24T08:17:50.152Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:45:41.038Z", "fetchedAt": "2026-10-24T08:31:09.312Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-07T00:00:00.000Z", "fetchedAt": "2026-10-24T08:17:50.152Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "https://github.com/rails/railsに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T08:31:09.312Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "26e93bf74901122767d5269d00434251bd815c2692789551a4e057de5b60ee06", "sourceModifiedAt": "2025-10-21T23:45:41.038Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Action View（バージョン 5.2.2.1 未満、5.1.6.2 未満、5.0.7.2 未満、4.2.11.1 未満、または v3）に対し、特別に細工した Accept ヘッダーを送信すると、対象サーバーの任意のファイルがレンダリングされ、ファイル内容が外部に漏洩するファイル内容開示脆弱性があります。", "risk": "攻撃者が細工した Accept ヘッダーを利用すると、サーバー上の任意のファイル内容が外部に公開される可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象は Action View が上記のバージョン範囲（5.2.2.1 未満、5.1.6.2 未満、5.0.7.2 未満、4.2.11.1 未満、または v3）であること、かつ攻撃者が特別に細工した Accept ヘッダーを送信できることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Rails。影響ありとして記載：5.2.2.1。影響ありとして記載：5.1.6.2。影響ありとして記載：5.0.7.2。影響ありとして記載：4.2.11.1。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json" ], "evidenceIds": [ "E3" ] }, { "text": "「https://github.com/rails/rails」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-5418", "https://www.exploit-db.com/exploits/46585/", "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html", "http://www.openwall.com/lists/oss-security/2019/03/22/1", "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q", "https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html", "https://access.redhat.com/errata/RHSA-2019:0796", "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/", "https://access.redhat.com/errata/RHSA-2019:1149", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "https://nvd.nist.gov/vuln/detail/CVE-2019-5418" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2019-5418", "https://www.exploit-db.com/exploits/46585/", "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html", "http://www.openwall.com/lists/oss-security/2019/03/22/1", "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q", "https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html", "https://access.redhat.com/errata/RHSA-2019:0796", "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/", "https://access.redhat.com/errata/RHSA-2019:1149", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "https://nvd.nist.gov/vuln/detail/CVE-2019-5418" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-5418", "https://www.exploit-db.com/exploits/46585/", "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html", "http://www.openwall.com/lists/oss-security/2019/03/22/1", "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q", "https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html", "https://access.redhat.com/errata/RHSA-2019:0796", "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/", "https://access.redhat.com/errata/RHSA-2019:1149", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "https://nvd.nist.gov/vuln/detail/CVE-2019-5418" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json", "label": "CVE：hackerone" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418", "label": "CVE公式レコード" }, { "url": "https://www.exploit-db.com/exploits/46585/", "label": "46585" }, { "url": "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html", "label": "CVE掲載の参考情報" }, { "url": "http://www.openwall.com/lists/oss-security/2019/03/22/1", "label": "[oss-security] 20190322 [CVE-2019-5418] Amendment: Possible Remote Code Execution Exploit in Action View" }, { "url": "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "label": "CVE掲載の参考情報" }, { "url": "https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q", "label": "CVE掲載の参考情報" }, { "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html", "label": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1739-1] rails security update" }, { "url": "https://access.redhat.com/errata/RHSA-2019:0796", "label": "RHSA-2019:0796" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html", "label": "openSUSE-SU-2019:1344" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/", "label": "FEDORA-2019-1cfe24db5c" }, { "url": "https://access.redhat.com/errata/RHSA-2019:1149", "label": "RHSA-2019:1149" }, { "url": "https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "sourceField": "retained:/originalText", "excerpt": "Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/5xxx/CVE-2019-5418.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"https://github.com/rails/rails\",\"vendor\":\"Rails\",\"versions\":[{\"status\":\"affected\",\"version\":\"5.2.2.1\"},{\"status\":\"affected\",\"version\":\"5.1.6.2\"},{\"status\":\"affected\",\"version\":\"5.0.7.2\"},{\"status\":\"affected\",\"version\":\"4.2.11.1\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-5418", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2019-5418\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2019-5418（https://github.com/rails/rails）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Action View が上記のバージョン範囲（5.2.2.1 未満、5.1.6.2 未満、5.0.7.2 未満、4.2.11.1 未満、または v3）であること、かつ攻撃者が特別に細工した Accept ヘッダーを送信できることが前提です。\n・公式の対象表：Rails。影響ありとして記載：5.2.2.1。影響ありとして記載：5.1.6.2。影響ありとして記載：5.0.7.2。影響ありとして記載：4.2.11.1。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2019-5418", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T08:31:09.312Z", "lastSuccess": "2026-10-24T08:31:09.312Z", "sourceCheckedAt": "2026-10-24T08:31:09.312Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2019-9621", "aliases": [], "title": "n/a：脆弱性情報", "summary": "Zimbra Collaboration Suite の 8.6 パッチ 13 以前、8.7 系列の 8.7.11 パッチ 10 以前、8.8 系列の 8.8.10 パッチ 7 以前、または 8.8.11 パッチ 3 以前では、ProxyServlet コンポーネントを通じてサーバー側リクエストフォージェリ（SSRF）が可能です。", "risk": "攻撃者がサーバー側で任意のリクエストを送信できるようになる可能性があります。", "product": "Synacor Zimbra Collaboration Suite (ZCS)", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-9621", "label": "CVE公式レコード" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "label": "CISAが示す関連情報" }, { "url": "https://wiki.zimbra.com/wiki/Security_Center", "label": "CISAが示す関連情報" }, { "url": "https://bugzilla.zimbra.com/show_bug.cgi?id=109127", "label": "CVE掲載の参考情報" }, { "url": "http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.exploit-db.com/exploits/46693/", "label": "46693" }, { "url": "https://blog.zimbra.com/2019/03/9826/", "label": "CVE掲載の参考情報" }, { "url": "https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9621", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2019-04-30T17:40:53.000Z", "modifiedAt": "2025-10-21T23:45:38.514Z", "fetchedAt": "2026-10-24T08:02:10.698Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2019-9621", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json", "fetchedAt": "2026-10-24T08:02:10.698Z", "publishedAt": "2019-04-30T17:40:53.000Z", "modifiedAt": "2025-10-21T23:45:38.514Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://wiki.zimbra.com/wiki/Security_Center", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://bugzilla.zimbra.com/show_bug.cgi?id=109127", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://www.exploit-db.com/exploits/46693/", "label": "46693", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://blog.zimbra.com/2019/03/9826/", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9621", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2019-9621:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621", "sourcePath": "retained:/originalText", "text": "Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2019-9621:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621", "modifiedAt": "2025-07-07T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:45:38.514Z", "fetchedAt": "2026-10-24T08:02:10.698Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-07T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T08:02:10.698Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3c7f484cb88c2c5bc61b7c65292520b25d1971df8c85b4405c5421f1a1fcd217", "sourceModifiedAt": "2025-10-21T23:45:38.514Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zimbra Collaboration Suite の 8.6 パッチ 13 以前、8.7 系列の 8.7.11 パッチ 10 以前、8.8 系列の 8.8.10 パッチ 7 以前、または 8.8.11 パッチ 3 以前では、ProxyServlet コンポーネントを通じてサーバー側リクエストフォージェリ（SSRF）が可能です。", "risk": "攻撃者がサーバー側で任意のリクエストを送信できるようになる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Synacor Zimbra Collaboration Suite (ZCS)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-9621", "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "https://wiki.zimbra.com/wiki/Security_Center", "https://bugzilla.zimbra.com/show_bug.cgi?id=109127", "http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce", "http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html", "https://www.exploit-db.com/exploits/46693/", "https://blog.zimbra.com/2019/03/9826/", "https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html", "http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621", "https://nvd.nist.gov/vuln/detail/CVE-2019-9621" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2019-9621", "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "https://wiki.zimbra.com/wiki/Security_Center", "https://bugzilla.zimbra.com/show_bug.cgi?id=109127", "http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce", "http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html", "https://www.exploit-db.com/exploits/46693/", "https://blog.zimbra.com/2019/03/9826/", "https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html", "http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621", "https://nvd.nist.gov/vuln/detail/CVE-2019-9621" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-9621", "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "https://wiki.zimbra.com/wiki/Security_Center", "https://bugzilla.zimbra.com/show_bug.cgi?id=109127", "http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce", "http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html", "https://www.exploit-db.com/exploits/46693/", "https://blog.zimbra.com/2019/03/9826/", "https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html", "http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621", "https://nvd.nist.gov/vuln/detail/CVE-2019-9621" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-9621", "label": "CVE公式レコード" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "label": "CISAが示す関連情報" }, { "url": "https://wiki.zimbra.com/wiki/Security_Center", "label": "CISAが示す関連情報" }, { "url": "https://bugzilla.zimbra.com/show_bug.cgi?id=109127", "label": "CVE掲載の参考情報" }, { "url": "http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.exploit-db.com/exploits/46693/", "label": "46693" }, { "url": "https://blog.zimbra.com/2019/03/9826/", "label": "CVE掲載の参考情報" }, { "url": "https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9621", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9621.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9621", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2019-9621\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2019-9621（Synacor Zimbra Collaboration Suite (ZCS)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2019-9621", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T08:02:10.698Z", "lastSuccess": "2026-10-24T08:02:10.698Z", "sourceCheckedAt": "2026-10-24T08:02:10.698Z", "errorCode": null }, "glossary": [ { "term": "SSRF", "meaning": "攻撃者が、サーバーに意図しない宛先へ通信を送らせる問題です。実際に送れる通信や影響の範囲は、それぞれの脆弱性の説明で確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF", "kind": "general_definition" } ] } }, { "id": "CVE-2025-1735", "aliases": [ "GHSA-hrwm-9436-5mv3" ], "title": "PHP：脆弱性情報", "summary": "PHP の pgsql および pdo_pgsql エスケープ関数は、基礎となるクオート関数がエラーを返したかどうかを確認しません。そのため、PostgreSQL サーバが文字列を無効として拒否した場合に、PHP がクラッシュする可能性があります。", "risk": "PostgreSQL サーバが文字列を無効として拒否したときに、PHP がクラッシュする可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 5.9, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.33（機能: pgsql / pdo_pgsql）" }, { "product": "PHP", "range": "8.2.* / < 8.2.29（機能: pgsql / pdo_pgsql）" }, { "product": "PHP", "range": "8.3.* / < 8.3.23（機能: pgsql / pdo_pgsql）" }, { "product": "PHP", "range": "8.4.* / < 8.4.10（機能: pgsql / pdo_pgsql）" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。（機能: pgsql / pdo_pgsql）" } ], "fixed": [ "8.1.33", "8.2.29", "8.3.23", "8.4.10" ], "steps": [ "PHP を 8.1.33、8.2.29、8.3.23、または 8.4.10 以上にアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1735", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-07-03T12:27:50.000Z", "modifiedAt": "2025-11-04T21:09:33.172Z", "fetchedAt": "2026-10-24T04:46:38.523Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.", "sourceTitle": "pgsql extension does not check for errors during escaping", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "modules": [ "pgsql", "pdo_pgsql" ], "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.33", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.29", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.23", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.10", "status": "affected", "version": "8.4.*", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: pgsql / pdo_pgsql。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-1735", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "fetchedAt": "2026-10-24T04:46:38.523Z", "publishedAt": "2025-07-13T22:27:48.299Z", "modifiedAt": "2025-11-04T21:09:33.172Z", "state": "published", "provider": "php", "title": "pgsql extension does not check for errors during escaping", "descriptions": [ { "lang": "en", "value": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nMissing error checking could result in SQL injection and missing error handling could lead to crashes due to null pointer dereferences.\n\n### Details\r\n\r\nThis is related to https://www.postgresql.org/support/security/CVE-2025-1094/ that was reported to postgres. The reporter used php to showcase the problem.\r\n\r\nWhile working on addressing the report, it was realised that PHP uses the escape functions in a way that does not allow for errors to be reported. Specifically the error parameters is not passed to PQescapeStringConn(), which therefore cannot report an error.\r\n\r\nWhile postgres now tries to make sure that the escaped string will trigger errors on the server-side if the string is invalidly encoded, that still can be insufficient, depending on how the escaped values are used.\r\n\r\nIt was also noted that several calls to PQescapeIdentifier() do not check for the returned value being NULL, despite that being the documented way that PQescapeIdentifier() (and PQescapeLiteral()) to report errors. Seems like that could cause crashes or at least UB in some of the callsites.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [ "pgsql", "pdo_pgsql" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.33", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.29", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.23", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.10", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.33; patched versions: 8.1.33", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.29; patched versions: 8.2.29", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.23; patched versions: 8.3.23", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.10; patched versions: 8.4.10", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-476", "lang": "en", "description": "CWE-476 NULL Pointer Dereference", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "http://www.openwall.com/lists/oss-security/2025/07/11/4", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"modules\":[\"pgsql\",\"pdo_pgsql\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.33\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.29\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.23\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.10\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-89\",\"description\":\"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-476\",\"description\":\"CWE-476 NULL Pointer Dereference\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hrwm-9436-5mv3:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3", "sourcePath": "/description", "text": "### Summary\r\n\r\nMissing error checking could result in SQL injection and missing error handling could lead to crashes due to null pointer dereferences.\n\n### Details\r\n\r\nThis is related to https://www.postgresql.org/support/security/CVE-2025-1094/ that was reported to postgres. The reporter used php to showcase the problem.\r\n\r\nWhile working on addressing the report, it was realised that PHP uses the escape functions in a way that does not allow for errors to be reported. Specifically the error parameters is not passed to PQescapeStringConn(), which therefore cannot report an error.\r\n\r\nWhile postgres now tries to make sure that the escaped string will trigger errors on the server-side if the string is invalidly encoded, that still can be insufficient, depending on how the escaped values are used.\r\n\r\nIt was also noted that several calls to PQescapeIdentifier() do not check for the returned value being NULL, despite that being the documented way that PQescapeIdentifier() (and PQescapeLiteral()) to report errors. Seems like that could cause crashes or at least UB in some of the callsites.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-hrwm-9436-5mv3:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.33\",\"patched_versions\":\"8.1.33\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hrwm-9436-5mv3:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.29\",\"patched_versions\":\"8.2.29\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hrwm-9436-5mv3:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.23\",\"patched_versions\":\"8.3.23\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hrwm-9436-5mv3:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.10\",\"patched_versions\":\"8.4.10\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-04T21:09:33.172Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hrwm-9436-5mv3", "modifiedAt": "2025-07-03T12:27:50.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-04T21:09:33.172Z", "fetchedAt": "2026-10-24T04:46:38.523Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-07-03T12:27:50.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:26:49.153Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "203115bd9fddaa85cac4ce6296c8b7070faa64a6be6906bc6f6bd14882808ad4", "sourceModifiedAt": "2025-11-04T21:09:33.172Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP の pgsql および pdo_pgsql エスケープ関数は、基礎となるクオート関数がエラーを返したかどうかを確認しません。そのため、PostgreSQL サーバが文字列を無効として拒否した場合に、PHP がクラッシュする可能性があります。", "risk": "PostgreSQL サーバが文字列を無効として拒否したときに、PHP がクラッシュする可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.1.*（8.1.33 未満）の pgsql と pdo_pgsql エスケープ関数はエラーをチェックしません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.2.*（8.2.29 未満）の pgsql と pdo_pgsql エスケープ関数はエラーをチェックしません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.3.*（8.3.23 未満）の pgsql と pdo_pgsql エスケープ関数はエラーをチェックしません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.4.*（8.4.10 未満）の pgsql と pdo_pgsql エスケープ関数はエラーをチェックしません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.33未満。影響ありとして記載：8.2系のうち、8.2.29未満。影響ありとして記載：8.3系のうち、8.3.23未満。影響ありとして記載：8.4系のうち、8.4.10未満。対象の機能：pgsql、pdo_pgsql。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.33、8.2.29、8.3.23、または 8.4.10 以上にアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-1735", "https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1735", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "sourceField": "/containers/cna/title", "excerpt": "pgsql extension does not check for errors during escaping", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1735.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"modules\":[\"pgsql\",\"pdo_pgsql\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.33\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.29\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.23\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.10\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3", "sourceField": "/fixed", "excerpt": "[\"8.1.33\",\"8.2.29\",\"8.3.23\",\"8.4.10\"]", "language": null } ], "supportRequest": "件名：CVE-2025-1735（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.*（8.1.33 未満）の pgsql と pdo_pgsql エスケープ関数はエラーをチェックしません。\n・PHP 8.2.*（8.2.29 未満）の pgsql と pdo_pgsql エスケープ関数はエラーをチェックしません。\n・PHP 8.3.*（8.3.23 未満）の pgsql と pdo_pgsql エスケープ関数はエラーをチェックしません。\n・PHP 8.4.*（8.4.10 未満）の pgsql と pdo_pgsql エスケープ関数はエラーをチェックしません。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.33未満。影響ありとして記載：8.2系のうち、8.2.29未満。影響ありとして記載：8.3系のうち、8.3.23未満。影響ありとして記載：8.4系のうち、8.4.10未満。対象の機能：pgsql、pdo_pgsql。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-1735", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:38.523Z", "lastSuccess": "2026-10-24T04:46:38.523Z", "sourceCheckedAt": "2026-10-24T04:46:38.523Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-6491", "aliases": [ "GHSA-453j-q27h-5p8x" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1.*（8.1.33 未満）、8.2.*（8.2.29 未満）、8.3.*（8.3.23 未満）、8.4.*（8.4.10 未満）の SOAP 拡張で XML データを解析する際、2GB を超える XML 名前空間プレフィックスがあると NULL ポインタ参照が発生する可能性があります。", "risk": "この NULL ポインタ参照によりサーバーがクラッシュし、対象サーバーの可用性が失われる可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 5.9, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.33" }, { "product": "PHP", "range": "8.2.* / < 8.2.29" }, { "product": "PHP", "range": "8.3.* / < 8.3.23" }, { "product": "PHP", "range": "8.4.* / < 8.4.10" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.33", "8.2.29", "8.3.23", "8.4.10" ], "steps": [ "PHP 8.1.33、8.2.29、8.3.23、8.4.10 にアップデートすれば修正されます。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-6491", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-07-03T12:27:21.000Z", "modifiedAt": "2025-11-04T21:14:48.898Z", "fetchedAt": "2026-10-24T04:46:40.080Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.", "sourceTitle": "NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "packageName": "soap", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.33", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.29", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.23", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.10", "status": "affected", "version": "8.4.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-6491", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json", "fetchedAt": "2026-10-24T04:46:40.080Z", "publishedAt": "2025-07-13T22:10:15.996Z", "modifiedAt": "2025-11-04T21:14:48.898Z", "state": "published", "provider": "php", "title": "NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix", "descriptions": [ { "lang": "en", "value": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nIf a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service.\r\n\r\n**Product**: PHP <= 8.5.0-dev with libxml2 < 2.13\r\n\r\n**Discovered by**: Ahmed Lekssays ([Qatar Computing Research Institute](https://cs.qcri.org)).\n\n### Details\r\nLibxml versions prior to 2.13 cannot correctly handle a call to xmlNodeSetName() with a name longer than 2G. It will leave the node object in an invalid state with a NULL name. This later causes a NULL pointer dereference when using the name during message serialization.\r\n\r\nThis can be exploited if a SoapVar is created with a fully qualified name that is longer than 2G. This would be possible if some application code uses a namespace prefix from an untrusted source like from a remote SOAP service.\n\n### Impact\r\nThis is a null pointer dereference vulnerability (CWE-476) that affects any PHP installation with the SOAP extension enabled. The vulnerability can be triggered when a SoapVar is created with a qualified name based on user-controlled SOAP data.\r\n\r\nImpact includes:\r\n- Denial of Service: Reliable crash causing PHP process termination\r\n- Service disruption: Affects web applications using SOAP functionality\n\n### GDB Trace\n\n### Valgrind Trace", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "soap", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.33", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.29", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.23", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.10", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.33; patched versions: 8.1.33", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.29; patched versions: 8.2.29", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.23; patched versions: 8.3.23", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.10; patched versions: 8.4.10", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-476", "lang": "en", "description": "CWE-476 NULL Pointer Dereference", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "http://www.openwall.com/lists/oss-security/2025/07/11/4", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"packageName\":\"soap\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.33\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.29\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.23\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.10\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-476\",\"description\":\"CWE-476 NULL Pointer Dereference\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-453j-q27h-5p8x:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x", "sourcePath": "/description", "text": "### Summary\r\n\r\nIf a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service.\r\n\r\n**Product**: PHP <= 8.5.0-dev with libxml2 < 2.13\r\n\r\n**Discovered by**: Ahmed Lekssays ([Qatar Computing Research Institute](https://cs.qcri.org)).\n\n### Details\r\nLibxml versions prior to 2.13 cannot correctly handle a call to xmlNodeSetName() with a name longer than 2G. It will leave the node object in an invalid state with a NULL name. This later causes a NULL pointer dereference when using the name during message serialization.\r\n\r\nThis can be exploited if a SoapVar is created with a fully qualified name that is longer than 2G. This would be possible if some application code uses a namespace prefix from an untrusted source like from a remote SOAP service.\n\n### Impact\r\nThis is a null pointer dereference vulnerability (CWE-476) that affects any PHP installation with the SOAP extension enabled. The vulnerability can be triggered when a SoapVar is created with a qualified name based on user-controlled SOAP data.\r\n\r\nImpact includes:\r\n- Denial of Service: Reliable crash causing PHP process termination\r\n- Service disruption: Affects web applications using SOAP functionality\n\n### GDB Trace\n\n### Valgrind Trace", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-453j-q27h-5p8x:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.33\",\"patched_versions\":\"8.1.33\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-453j-q27h-5p8x:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.29\",\"patched_versions\":\"8.2.29\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-453j-q27h-5p8x:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.23\",\"patched_versions\":\"8.3.23\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-453j-q27h-5p8x:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.10\",\"patched_versions\":\"8.4.10\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-04T21:14:48.898Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-453j-q27h-5p8x", "modifiedAt": "2025-07-03T15:16:04.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-04T21:14:48.898Z", "fetchedAt": "2026-10-24T04:46:40.080Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-07-03T15:16:04.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:26:49.501Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "17e68f5bd45740be4b4ba7a48d4cee45a09191b2e307bba4e4a2bd3a42903a86", "sourceModifiedAt": "2025-11-04T21:14:48.898Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.33 未満）、8.2.*（8.2.29 未満）、8.3.*（8.3.23 未満）、8.4.*（8.4.10 未満）の SOAP 拡張で XML データを解析する際、2GB を超える XML 名前空間プレフィックスがあると NULL ポインタ参照が発生する可能性があります。", "risk": "この NULL ポインタ参照によりサーバーがクラッシュし、対象サーバーの可用性が失われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.1.* でバージョン 8.1.33 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.2.* でバージョン 8.2.29 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.3.* でバージョン 8.3.23 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.4.* でバージョン 8.4.10 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "SOAP 拡張が有効になっている PHP インストールが対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.33未満。影響ありとして記載：8.2系のうち、8.2.29未満。影響ありとして記載：8.3系のうち、8.3.23未満。影響ありとして記載：8.4系のうち、8.4.10未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP 8.1.33、8.2.29、8.3.23、8.4.10 にアップデートすれば修正されます。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-6491", "https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-6491", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json", "sourceField": "/containers/cna/title", "excerpt": "NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6491.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"packageName\":\"soap\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.33\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.29\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.23\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.10\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x", "sourceField": "/fixed", "excerpt": "[\"8.1.33\",\"8.2.29\",\"8.3.23\",\"8.4.10\"]", "language": null } ], "supportRequest": "件名：CVE-2025-6491（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.* でバージョン 8.1.33 未満のものは影響を受けます。\n・PHP 8.2.* でバージョン 8.2.29 未満のものは影響を受けます。\n・PHP 8.3.* でバージョン 8.3.23 未満のものは影響を受けます。\n・PHP 8.4.* でバージョン 8.4.10 未満のものは影響を受けます。\n・SOAP 拡張が有効になっている PHP インストールが対象です。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.33未満。影響ありとして記載：8.2系のうち、8.2.29未満。影響ありとして記載：8.3系のうち、8.3.23未満。影響ありとして記載：8.4系のうち、8.4.10未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-6491", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:40.080Z", "lastSuccess": "2026-10-24T04:46:40.080Z", "sourceCheckedAt": "2026-10-24T04:46:40.080Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-1220", "aliases": [ "GHSA-3cr5-j632-f35r" ], "title": "PHP：脆弱性情報", "summary": "PHP のバージョン 8.1.*（8.1.33 未満）、8.2.*（8.2.29 未満）、8.3.*（8.3.23 未満）、8.4.*（8.4.10 未満）において、fsockopen() などの関数がホスト名に null バイトが含まれているかを検証しないため、parse_url() など他の関数と挙動が異なり、ユーザーコードがアクセスチェックを行っていてもセキュリティ上の問題が生じる可能性があります。", "risk": "サーバー側リクエストフォージェリ（SSRF）が発生し、攻撃者が意図しない内部サーバーやサービスへリクエストを送信できる可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "low", "cvss": 3.7, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.33" }, { "product": "PHP", "range": "8.2.* / < 8.2.29" }, { "product": "PHP", "range": "8.3.* / < 8.3.23" }, { "product": "PHP", "range": "8.4.* / < 8.4.10" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.33", "8.2.29", "8.3.23", "8.4.10" ], "steps": [ "PHP を 8.1.33、8.2.29、8.3.23、8.4.10 以上のバージョンにアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1220", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-07-03T12:27:07.000Z", "modifiedAt": "2026-05-19T20:16:40.000Z", "fetchedAt": "2026-10-24T04:46:41.606Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.", "sourceTitle": "Null byte termination in hostnames", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.33", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.29", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.23", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.10", "status": "affected", "version": "8.4.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-1220", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "fetchedAt": "2026-10-24T04:46:41.606Z", "publishedAt": "2025-07-13T22:18:36.974Z", "modifiedAt": "2026-05-19T20:16:40.000Z", "state": "published", "provider": "php", "title": "Null byte termination in hostnames", "descriptions": [ { "lang": "en", "value": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n`fsockopen()` doesn't regard `hostname` as well, `hostname` is terminated at the null byte. This can cause Server Side Request Forgery in general case.\n\n### Details\r\n\r\nDuring `fsockopen` is being called `hostname` is passed directly to the low-level C function calls.\r\n\r\n[/etc/standard/fsock.c:50](https://github.com/php/php-src/blob/80637d11b39b26f32fc2fbf5150c9564dd30edd5/ext/standard/fsock.c#L50)\r\n\r\n\r\nWhen `fsockopen()` is called, it retrieves hostname from first parameter, into `host` and `host_len`. `host` can contain null bytes in the middle of the string, but `host_len` can be used to prevent unexpected null termination. These two `host` and `host_len` is passed to `php_stream_xport_create()`\r\n\r\n\r\n[/main/streams/transports.c:_php_stream_xporet_create()](https://github.com/php/php-src/blob/80637d11b39b26f32fc2fbf5150c9564dd30edd5/main/streams/transports.c#L97)\r\n\r\n\r\n\r\nAfter TCP factory is selected, `php_network_getaddresses()` is called, but still null bytes or any control characters are not processed. This will lead Server Side Request Forgery.\r\n\r\nWhile other url-related functions like [parse_url](https://github.com/php/php-src/blob/80637d11b39b26f32fc2fbf5150c9564dd30edd5/ext/standard/url.c#L319) has processing logic using `zend_string` type and `iscntrl()` check. This difference can be used to trigger SSRF in general case.\r\n\r\nFor example, one developer can write following reasonable code.\r\n\r\n\r\n\r\nWhen `$connect_host` is given as `localhost\\0.safedomain.com`, `parse_url` will return `localhost_.safedomain.com` as its host, which can pass the security check, but `fsockopen()` will connect to `localhost` and occurs server side request forgery.\n\n### Impact\r\n\r\nServer Side Request Forgery\n\n### Classification\r\n\r\nPHP does not usually classify `\\0` as a security issue because users are expected to sanitize the input. Nevertheless this was considered as a low impact security issue as a precaution for users that do not do that. It also take into account that the patch is simple.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.33", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.29", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.23", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.10", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.33; patched versions: 8.1.33", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.29; patched versions: 8.2.29", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.23; patched versions: 8.3.23", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.10; patched versions: 8.4.10", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.7, "baseSeverity": "LOW", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "http://www.openwall.com/lists/oss-security/2025/07/11/4", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.33\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.29\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.23\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.10\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-918\",\"description\":\"CWE-918 Server-Side Request Forgery (SSRF)\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3cr5-j632-f35r:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r", "sourcePath": "/description", "text": "### Summary\r\n`fsockopen()` doesn't regard `hostname` as well, `hostname` is terminated at the null byte. This can cause Server Side Request Forgery in general case.\n\n### Details\r\n\r\nDuring `fsockopen` is being called `hostname` is passed directly to the low-level C function calls.\r\n\r\n[/etc/standard/fsock.c:50](https://github.com/php/php-src/blob/80637d11b39b26f32fc2fbf5150c9564dd30edd5/ext/standard/fsock.c#L50)\r\n\r\n\r\nWhen `fsockopen()` is called, it retrieves hostname from first parameter, into `host` and `host_len`. `host` can contain null bytes in the middle of the string, but `host_len` can be used to prevent unexpected null termination. These two `host` and `host_len` is passed to `php_stream_xport_create()`\r\n\r\n\r\n[/main/streams/transports.c:_php_stream_xporet_create()](https://github.com/php/php-src/blob/80637d11b39b26f32fc2fbf5150c9564dd30edd5/main/streams/transports.c#L97)\r\n\r\n\r\n\r\nAfter TCP factory is selected, `php_network_getaddresses()` is called, but still null bytes or any control characters are not processed. This will lead Server Side Request Forgery.\r\n\r\nWhile other url-related functions like [parse_url](https://github.com/php/php-src/blob/80637d11b39b26f32fc2fbf5150c9564dd30edd5/ext/standard/url.c#L319) has processing logic using `zend_string` type and `iscntrl()` check. This difference can be used to trigger SSRF in general case.\r\n\r\nFor example, one developer can write following reasonable code.\r\n\r\n\r\n\r\nWhen `$connect_host` is given as `localhost\\0.safedomain.com`, `parse_url` will return `localhost_.safedomain.com` as its host, which can pass the security check, but `fsockopen()` will connect to `localhost` and occurs server side request forgery.\n\n### Impact\r\n\r\nServer Side Request Forgery\n\n### Classification\r\n\r\nPHP does not usually classify `\\0` as a security issue because users are expected to sanitize the input. Nevertheless this was considered as a low impact security issue as a precaution for users that do not do that. It also take into account that the patch is simple.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-3cr5-j632-f35r:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.33\",\"patched_versions\":\"8.1.33\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3cr5-j632-f35r:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.29\",\"patched_versions\":\"8.2.29\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3cr5-j632-f35r:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.23\",\"patched_versions\":\"8.3.23\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3cr5-j632-f35r:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.10\",\"patched_versions\":\"8.4.10\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-04T21:09:17.792Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r", "modifiedAt": "2026-05-19T20:16:40.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-04T21:09:17.792Z", "fetchedAt": "2026-10-24T04:46:41.606Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-19T20:16:40.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:26:49.739Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d2e29175e344c3d4c607ae4a103ffd1a9b6795e85985fe3206f16824507dd5d0", "sourceModifiedAt": "2026-05-19T20:16:40.000Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP のバージョン 8.1.*（8.1.33 未満）、8.2.*（8.2.29 未満）、8.3.*（8.3.23 未満）、8.4.*（8.4.10 未満）において、fsockopen() などの関数がホスト名に null バイトが含まれているかを検証しないため、parse_url() など他の関数と挙動が異なり、ユーザーコードがアクセスチェックを行っていてもセキュリティ上の問題が生じる可能性があります。", "risk": "サーバー側リクエストフォージェリ（SSRF）が発生し、攻撃者が意図しない内部サーバーやサービスへリクエストを送信できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "PHP 8.1.*（8.1.33 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.2.*（8.2.29 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.3.*（8.3.23 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.4.*（8.4.10 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "fsockopen() 関数がホスト名に null バイトが含まれていても検証しないため、SSRF が発生し得ます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.33未満。影響ありとして記載：8.2系のうち、8.2.29未満。影響ありとして記載：8.3系のうち、8.3.23未満。影響ありとして記載：8.4系のうち、8.4.10未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.33、8.2.29、8.3.23、8.4.10 以上のバージョンにアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r" ], "evidenceIds": [ "E5" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-1220", "https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1220", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "sourceField": "/containers/cna/title", "excerpt": "Null byte termination in hostnames", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3cr5-j632-f35r", "sourceField": "/description", "excerpt": "### Summary\r\n`fsockopen()` doesn't regard `hostname` as well, `hostname` is terminated at the null byte. This can cause Server Side Request Forgery in general case.\n\n### Details\r\n\r\nDuring `fsockopen` is being called `hostname` is passed directly to the low-level C function calls.\r\n\r\n[/etc/standard/fsock.c:50](https://github.com/php/php-src/blob/80637d11b39b26f32fc2fbf5150c9564dd30edd5/ext/standard/fsock.c#L50)\r\n\r\n\r\nWhen `fsockopen()` is called, it retrieves hostname from first parameter, into `host` and `host_len`. `host` can contain null bytes in the middle of the string, but `host_len` can be used to prevent unexpected null termination. These two `host` and `host_len` is passed to `php_stream_xport_create()`\r\n\r\n\r\n[/main/streams/transports.c:_php_stream_xporet_create()](https://github.com/php/php-src/blob/80637d11b39b26f32fc2fbf5150c9564dd30edd5/main/streams/transports.c#L97)\r\n\r\n\r\n\r\nAfter TCP factory is selected, `php_network_getaddresses()` is called, but still null bytes or any control characters are not processed. This will lead Server Side Request Forgery.\r\n\r\nWhile other url-related functions like [parse_url](https://github.com/php/php-src/blob/80637d11b39b26f32fc2fbf5150c9564dd30edd5/ext/standard/url.c#L319) has processing logic using `zend_string` type and `iscntrl()` check. This difference can be used to trigger SSRF in general case.\r\n\r\nFor example, one developer can write following reasonable code.\r\n\r\n\r\n\r\nWhen `$connect_host` is given as `localhost\\0.safedomain.com`, `parse_url` will return `localhost_.safedomain.com` as its host, which can pass the security check, but `fsockopen()` will connect to `localhost` and occurs server side request forgery.\n\n### Impact\r\n\r\nServer Side Request Forgery\n\n### Classification\r\n\r\nPHP does not usually classify `\\0` as a security issue because users are expected to sanitize the input. Nevertheless this was considered as a low impact security issue as a precaution for users that do not do that. It also take into account that the patch is simple.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1220.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.33\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.29\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.23\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.10\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r", "sourceField": "/fixed", "excerpt": "[\"8.1.33\",\"8.2.29\",\"8.3.23\",\"8.4.10\"]", "language": null } ], "supportRequest": "件名：CVE-2025-1220（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.*（8.1.33 未満）が影響を受けます。\n・PHP 8.2.*（8.2.29 未満）が影響を受けます。\n・PHP 8.3.*（8.3.23 未満）が影響を受けます。\n・PHP 8.4.*（8.4.10 未満）が影響を受けます。\n・fsockopen() 関数がホスト名に null バイトが含まれていても検証しないため、SSRF が発生し得ます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.33未満。影響ありとして記載：8.2系のうち、8.2.29未満。影響ありとして記載：8.3系のうち、8.3.23未満。影響ありとして記載：8.4系のうち、8.4.10未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-1220", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:41.606Z", "lastSuccess": "2026-10-24T04:46:41.606Z", "sourceCheckedAt": "2026-10-24T04:46:41.606Z", "errorCode": null }, "glossary": [ { "term": "SSRF", "meaning": "攻撃者が、サーバーに意図しない宛先へ通信を送らせる問題です。実際に送れる通信や影響の範囲は、それぞれの脆弱性の説明で確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF", "kind": "general_definition" } ] } }, { "id": "CVE-2025-6554", "aliases": [], "title": "Chrome：脆弱性情報", "summary": "Google Chrome の V8 エンジンに型混同の欠陥があり、138.0.7204.96 より前のバージョンで、攻撃者が細工した HTML ページを用いることで任意のメモリ読み書きが可能になる。", "risk": "この欠陥により、攻撃者はブラウザー上で任意のデータを読み取ったり書き換えたりできる。", "product": "Chrome", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Chrome", "cvssVector": null, "affected": [ { "product": "Chrome", "range": ">= 138.0.7204.96 / < 138.0.7204.96" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-6554", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html", "label": "CVE掲載の参考情報" }, { "url": "https://issues.chromium.org/issues/427663123", "label": "CVE掲載の参考情報" }, { "url": "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html?m=1", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6554", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-06-30T21:14:14.799Z", "modifiedAt": "2025-10-21T22:45:23.208Z", "fetchedAt": "2026-10-24T06:03:47.650Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Chrome", "versions": [ { "version": "138.0.7204.96", "status": "affected", "lessThan": "138.0.7204.96", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-6554", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json", "fetchedAt": "2026-10-24T06:03:47.650Z", "publishedAt": "2025-06-30T21:14:14.799Z", "modifiedAt": "2025-10-21T22:45:23.208Z", "state": "published", "provider": "Chrome", "title": "", "descriptions": [ { "lang": "en", "value": "Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Google", "product": "Chrome", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "138.0.7204.96", "lessThan": "138.0.7204.96", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-843", "lang": "en", "description": "Type Confusion", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/0" }, { "url": "https://issues.chromium.org/issues/427663123", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6554", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"138.0.7204.96\",\"status\":\"affected\",\"lessThan\":\"138.0.7204.96\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Type Confusion\",\"cweId\":\"CWE-843\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.1,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-6554:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554", "sourcePath": "retained:/originalText", "text": "Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-6554:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554", "modifiedAt": "2025-07-02T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:45:23.208Z", "fetchedAt": "2026-10-24T06:03:47.650Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-02T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Chromeに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:03:47.650Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "aaf47acee2c2cca92b05c24469473fe6ec8205e42c4c6a1dcc9114c901b4937c", "sourceModifiedAt": "2025-10-21T22:45:23.208Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Google Chrome の V8 エンジンに型混同の欠陥があり、138.0.7204.96 より前のバージョンで、攻撃者が細工した HTML ページを用いることで任意のメモリ読み書きが可能になる。", "risk": "この欠陥により、攻撃者はブラウザー上で任意のデータを読み取ったり書き換えたりできる。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者はリモートから細工した HTML ページを配布し、ユーザーがそのページを閲覧するだけで実行できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも138.0.7204.96で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Chrome」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-6554", "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html", "https://issues.chromium.org/issues/427663123", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554", "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html?m=1", "https://nvd.nist.gov/vuln/detail/CVE-2025-6554" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-6554", "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html", "https://issues.chromium.org/issues/427663123", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554", "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html?m=1", "https://nvd.nist.gov/vuln/detail/CVE-2025-6554" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-6554", "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html", "https://issues.chromium.org/issues/427663123", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554", "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html?m=1", "https://nvd.nist.gov/vuln/detail/CVE-2025-6554" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-6554", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html", "label": "CVE掲載の参考情報" }, { "url": "https://issues.chromium.org/issues/427663123", "label": "CVE掲載の参考情報" }, { "url": "https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html?m=1", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6554", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6554.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"138.0.7204.96\",\"status\":\"affected\",\"lessThan\":\"138.0.7204.96\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6554", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-6554\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-6554（Chrome）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者はリモートから細工した HTML ページを配布し、ユーザーがそのページを閲覧するだけで実行できる。\n・公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも138.0.7204.96で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-6554", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:03:47.650Z", "lastSuccess": "2026-10-24T06:03:47.650Z", "sourceCheckedAt": "2026-10-24T06:03:47.650Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-48927", "aliases": [], "title": "service：脆弱性情報", "summary": "TeleMessage のサービスは 2025‑05‑05 までに Spring Boot Actuator を設定し、/heapdump URI でヒープダンプを公開するエンドポイントを設置しています。この設定は 2025 年 5 月に実際に悪用されました。", "risk": "記載された説明文には具体的な被害や影響は示されていません。", "product": "service", "category": "other", "component": "package", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "service", "range": "<= 2025-05-05" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-48927", "label": "CVE公式レコード" }, { "url": "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48927", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-05-28T00:00:00.000Z", "modifiedAt": "2026-02-26T18:27:53.525Z", "fetchedAt": "2026-10-24T04:46:42.904Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unknown", "product": "service", "vendor": "TeleMessage", "versions": [ { "lessThanOrEqual": "2025-05-05", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-48927", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json", "fetchedAt": "2026-10-24T04:46:42.904Z", "publishedAt": "2025-05-28T00:00:00.000Z", "modifiedAt": "2026-02-26T18:27:53.525Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "TeleMessage", "product": "service", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2025-05-05", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-1188", "lang": "en", "description": "CWE-1188 Initialization of a Resource with an Insecure Default", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48927", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unknown\",\"product\":\"service\",\"vendor\":\"TeleMessage\",\"versions\":[{\"lessThanOrEqual\":\"2025-05-05\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-1188\",\"description\":\"CWE-1188 Initialization of a Resource with an Insecure Default\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-48927:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "sourcePath": "retained:/originalText", "text": "TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-48927:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "modifiedAt": "2025-07-01T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T18:27:53.525Z", "fetchedAt": "2026-10-24T04:46:42.904Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-01T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "serviceに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:46:42.904Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c6d4747f9684429992f515f8cb1b2267a789481196c2f523e517e6fa29e70af1", "sourceModifiedAt": "2026-02-26T18:27:53.525Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "TeleMessage のサービスは 2025‑05‑05 までに Spring Boot Actuator を設定し、/heapdump URI でヒープダンプを公開するエンドポイントを設置しています。この設定は 2025 年 5 月に実際に悪用されました。", "risk": "記載された説明文には具体的な被害や影響は示されていません。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Spring Boot Actuator が /heapdump エンドポイントを公開していることが条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：TeleMessage / service。影響ありとして記載：2025-05-05以下の版。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json" ], "evidenceIds": [ "E2" ] }, { "text": "「service」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-48927", "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "https://nvd.nist.gov/vuln/detail/CVE-2025-48927" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-48927", "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "https://nvd.nist.gov/vuln/detail/CVE-2025-48927" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-48927", "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "https://nvd.nist.gov/vuln/detail/CVE-2025-48927" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-48927", "label": "CVE公式レコード" }, { "url": "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48927", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48927.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unknown\",\"product\":\"service\",\"vendor\":\"TeleMessage\",\"versions\":[{\"lessThanOrEqual\":\"2025-05-05\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-48927\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-48927（service）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Spring Boot Actuator が /heapdump エンドポイントを公開していることが条件です。\n・公式の対象表：TeleMessage / service。影響ありとして記載：2025-05-05以下の版。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-48927", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:42.904Z", "lastSuccess": "2026-10-24T04:46:42.904Z", "sourceCheckedAt": "2026-10-24T04:46:42.904Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-48928", "aliases": [], "title": "service：脆弱性情報", "summary": "TeleMessage サービス（2025‑05‑05 まで）は JSP アプリケーションで構成されており、ヒープの内容が「コアダンプ」に相当します。このダンプには、以前 HTTP 経由で送信されたパスワードが含まれる可能性があり、2025 年 5 月に実際に悪用されました。", "risk": "パスワードがコアダンプに含まれることで、認可されていない者に漏洩する恐れがあります。", "product": "service", "category": "other", "component": "package", "severity": "medium", "cvss": 4, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "service", "range": "<= 2025-05-05" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-48928", "label": "CVE公式レコード" }, { "url": "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48928", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-05-28T00:00:00.000Z", "modifiedAt": "2026-02-26T18:27:52.827Z", "fetchedAt": "2026-10-24T04:46:45.105Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unknown", "product": "service", "vendor": "TeleMessage", "versions": [ { "lessThanOrEqual": "2025-05-05", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-48928", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json", "fetchedAt": "2026-10-24T04:46:45.105Z", "publishedAt": "2025-05-28T00:00:00.000Z", "modifiedAt": "2026-02-26T18:27:52.827Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "TeleMessage", "product": "service", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2025-05-05", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-528", "lang": "en", "description": "CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4, "baseSeverity": "MEDIUM", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48928", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unknown\",\"product\":\"service\",\"vendor\":\"TeleMessage\",\"versions\":[{\"lessThanOrEqual\":\"2025-05-05\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-528\",\"description\":\"CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":4,\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-48928:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928", "sourcePath": "retained:/originalText", "text": "TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-48928:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928", "modifiedAt": "2025-07-01T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T18:27:52.827Z", "fetchedAt": "2026-10-24T04:46:45.105Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-07-01T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "serviceに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:46:45.105Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8a269ae319e9633a309ce0d15649bd773eae9d4b3843195c780843af50fb647e", "sourceModifiedAt": "2026-02-26T18:27:52.827Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "TeleMessage サービス（2025‑05‑05 まで）は JSP アプリケーションで構成されており、ヒープの内容が「コアダンプ」に相当します。このダンプには、以前 HTTP 経由で送信されたパスワードが含まれる可能性があり、2025 年 5 月に実際に悪用されました。", "risk": "パスワードがコアダンプに含まれることで、認可されていない者に漏洩する恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象は TeleMessage の JSP アプリケーションを使用しているサービスで、バージョンが 2025‑05‑05 までのものです。HTTP 経由で送信されたパスワードがヒープに残り、コアダンプに含まれる可能性があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：TeleMessage / service。影響ありとして記載：2025-05-05以下の版。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json" ], "evidenceIds": [ "E3" ] }, { "text": "「service」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-48928", "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928", "https://nvd.nist.gov/vuln/detail/CVE-2025-48928" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-48928", "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928", "https://nvd.nist.gov/vuln/detail/CVE-2025-48928" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-48928", "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928", "https://nvd.nist.gov/vuln/detail/CVE-2025-48928" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-48928", "label": "CVE公式レコード" }, { "url": "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48928", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"cweId\":\"CWE-528\",\"description\":\"CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere\",\"lang\":\"en\",\"type\":\"CWE\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48928.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unknown\",\"product\":\"service\",\"vendor\":\"TeleMessage\",\"versions\":[{\"lessThanOrEqual\":\"2025-05-05\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48928", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-48928\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-48928（service）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は TeleMessage の JSP アプリケーションを使用しているサービスで、バージョンが 2025‑05‑05 までのものです。HTTP 経由で送信されたパスワードがヒープに残り、コアダンプに含まれる可能性があります。\n・公式の対象表：TeleMessage / service。影響ありとして記載：2025-05-05以下の版。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-48928", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:45.105Z", "lastSuccess": "2026-10-24T04:46:45.105Z", "sourceCheckedAt": "2026-10-24T04:46:45.105Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-6543", "aliases": [], "title": "ADC / Gateway：サービス停止", "summary": "NetScaler ADC および NetScaler Gateway が Gateway（VPN 仮想サーバー、ICA プロキシ、CVPN、RDP プロキシ）または AAA 仮想サーバーとして構成されている場合に、メモリオーバーフローが発生し、意図しない制御フローとサービス拒否が起こります。", "risk": "意図しない制御フローによりシステムが予期せぬ動作をし、サービス拒否によりサイトや機能が利用できなくなる可能性があります。", "product": "ADC / Gateway", "category": "other", "component": "package", "severity": "critical", "cvss": 9.2, "cvssVersion": "4.0", "cvssSource": "Citrix", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "affected": [ { "product": "ADC", "range": ">= 14.1 / < 47.46" }, { "product": "ADC", "range": ">= 13.1 / < 59.19" }, { "product": "ADC", "range": ">= 13.1 FIPS and NDcPP / < 37.236" }, { "product": "Gateway", "range": ">= 14.1 / < 47.46" }, { "product": "Gateway", "range": ">= 13.1 / < 59.19" }, { "product": "Gateway", "range": ">= 13.1 FIPS and NDcPP / < 37.236" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "label": "CVE：Citrix" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-6543", "label": "CVE公式レコード" }, { "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788", "label": "CISAが示す関連情報" }, { "url": "https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6543", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-06-25T12:49:57.896Z", "modifiedAt": "2026-02-26T17:50:24.557Z", "fetchedAt": "2026-10-24T04:46:52.536Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server", "sourceTitle": "Memory overflow vulnerability leading to unintended control flow and Denial of Service", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "ADC", "vendor": "NetScaler", "versions": [ { "lessThan": "47.46", "status": "affected", "version": "14.1", "versionType": "patch" }, { "lessThan": "59.19", "status": "affected", "version": "13.1", "versionType": "patch" }, { "lessThan": "37.236", "status": "affected", "version": "13.1 FIPS and NDcPP", "versionType": "patch" } ] }, { "defaultStatus": "unaffected", "product": "Gateway", "vendor": "NetScaler", "versions": [ { "lessThan": "47.46", "status": "affected", "version": "14.1", "versionType": "patch" }, { "lessThan": "59.19", "status": "affected", "version": "13.1", "versionType": "patch" }, { "lessThan": "37.236", "status": "affected", "version": "13.1 FIPS and NDcPP", "versionType": "patch" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-6543", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "fetchedAt": "2026-10-24T04:46:52.536Z", "publishedAt": "2025-06-25T12:49:57.896Z", "modifiedAt": "2026-02-26T17:50:24.557Z", "state": "published", "provider": "Citrix", "title": "Memory overflow vulnerability leading to unintended control flow and Denial of Service", "descriptions": [ { "lang": "en", "value": "Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "NetScaler", "product": "ADC", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "14.1", "lessThan": "47.46", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "13.1", "lessThan": "59.19", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "13.1 FIPS and NDcPP", "lessThan": "37.236", "versionType": "patch", "status": "affected" } ] }, { "vendor": "NetScaler", "product": "Gateway", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "14.1", "lessThan": "47.46", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "13.1", "lessThan": "59.19", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "13.1 FIPS and NDcPP", "lessThan": "37.236", "versionType": "patch", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-119", "lang": "en", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "baseScore": 9.2, "baseSeverity": "CRITICAL", "provider": "Citrix", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788", "label": "Citrix", "tags": [], "provider": "Citrix", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6543", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"ADC\",\"vendor\":\"NetScaler\",\"versions\":[{\"lessThan\":\"47.46\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"59.19\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"},{\"lessThan\":\"37.236\",\"status\":\"affected\",\"version\":\"13.1 FIPS and NDcPP\",\"versionType\":\"patch\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Gateway\",\"vendor\":\"NetScaler\",\"versions\":[{\"lessThan\":\"47.46\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"59.19\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"},{\"lessThan\":\"37.236\",\"status\":\"affected\",\"version\":\"13.1 FIPS and NDcPP\",\"versionType\":\"patch\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-119\",\"description\":\"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"attackVector\":\"NETWORK\",\"baseScore\":9.2,\"baseSeverity\":\"CRITICAL\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"HIGH\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-6543:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "sourcePath": "retained:/originalText", "text": "Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-6543:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "modifiedAt": "2025-06-30T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T17:50:24.557Z", "fetchedAt": "2026-10-24T04:46:52.536Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-06-30T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "ADC / Gatewayにサービス停止に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "処理の停止や過大な負荷により、サービスを利用できなくなる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:46:52.536Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "6267d062d3640cac1147e757ce971e6ed651bbb1b8f040762b0667e726189b27", "sourceModifiedAt": "2026-02-26T17:50:24.557Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "NetScaler ADC および NetScaler Gateway が Gateway（VPN 仮想サーバー、ICA プロキシ、CVPN、RDP プロキシ）または AAA 仮想サーバーとして構成されている場合に、メモリオーバーフローが発生し、意図しない制御フローとサービス拒否が起こります。", "risk": "意図しない制御フローによりシステムが予期せぬ動作をし、サービス拒否によりサイトや機能が利用できなくなる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は NetScaler ADC および NetScaler Gateway が、Gateway（VPN 仮想サーバー、ICA プロキシ、CVPN、RDP プロキシ）または AAA 仮想サーバーとして設定されている場合です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "公式の対象表：NetScaler / ADC。影響ありとして記載：14.1以上、47.46未満。影響ありとして記載：13.1以上、59.19未満。影響ありとして記載：13.1 FIPS and NDcPP以上、37.236未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：NetScaler / Gateway。影響ありとして記載：14.1以上、47.46未満。影響ありとして記載：13.1以上、59.19未満。影響ありとして記載：13.1 FIPS and NDcPP以上、37.236未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json" ], "evidenceIds": [ "E4" ] }, { "text": "「ADC / Gateway」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-6543", "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/", "https://nvd.nist.gov/vuln/detail/CVE-2025-6543" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-6543", "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/", "https://nvd.nist.gov/vuln/detail/CVE-2025-6543" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-6543", "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/", "https://nvd.nist.gov/vuln/detail/CVE-2025-6543" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "label": "CVE：Citrix" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-6543", "label": "CVE公式レコード" }, { "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788", "label": "CISAが示す関連情報" }, { "url": "https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6543", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "sourceField": "/containers/cna/title", "excerpt": "Memory overflow vulnerability leading to unintended control flow and Denial of Service", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "sourceField": "retained:/originalText", "excerpt": "Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"ADC\",\"vendor\":\"NetScaler\",\"versions\":[{\"lessThan\":\"47.46\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"59.19\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"},{\"lessThan\":\"37.236\",\"status\":\"affected\",\"version\":\"13.1 FIPS and NDcPP\",\"versionType\":\"patch\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6543.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Gateway\",\"vendor\":\"NetScaler\",\"versions\":[{\"lessThan\":\"47.46\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"59.19\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"},{\"lessThan\":\"37.236\",\"status\":\"affected\",\"version\":\"13.1 FIPS and NDcPP\",\"versionType\":\"patch\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-6543\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-6543（ADC / Gateway）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は NetScaler ADC および NetScaler Gateway が、Gateway（VPN 仮想サーバー、ICA プロキシ、CVPN、RDP プロキシ）または AAA 仮想サーバーとして設定されている場合です。\n・公式の対象表：NetScaler / ADC。影響ありとして記載：14.1以上、47.46未満。影響ありとして記載：13.1以上、59.19未満。影響ありとして記載：13.1 FIPS and NDcPP以上、37.236未満。\n・公式の対象表：NetScaler / Gateway。影響ありとして記載：14.1以上、47.46未満。影響ありとして記載：13.1以上、59.19未満。影響ありとして記載：13.1 FIPS and NDcPP以上、37.236未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-6543", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:52.536Z", "lastSuccess": "2026-10-24T04:46:52.536Z", "sourceCheckedAt": "2026-10-24T04:46:52.536Z", "errorCode": null }, "glossary": [ { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2019-6693", "aliases": [], "title": "FortiGate：脆弱性情報", "summary": "FortiOS の設定バックアップファイルでハードコードされた暗号鍵が使用されており、攻撃者がバックアップファイルにアクセスし、ハードコード鍵を知っている場合、機密データを復号できる可能性があります。機密データには、管理者以外のユーザーのパスワード、プライベートキーのパスフレーズ、設定されている場合の高可用性パスワードが含まれます。", "risk": "機密データが復号されることで、ユーザーのパスワードやプライベートキーのパスフレーズ、高可用性パスワードが漏洩する情報開示のリスクがあります。", "product": "FortiGate", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "fortinet", "cvssVector": null, "affected": [ { "product": "FortiGate", "range": "5.6.9 and below" }, { "product": "FortiGate", "range": "6.0.5 and below" }, { "product": "FortiGate", "range": "6.2.0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-6693", "label": "CVE公式レコード" }, { "url": "https://fortiguard.com/advisory/FG-IR-19-007", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6693", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2019-11-21T15:08:05.000Z", "modifiedAt": "2026-08-04T03:55:51.284Z", "fetchedAt": "2026-10-24T04:46:56.988Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "FortiGate", "vendor": "Fortinet", "versions": [ { "status": "affected", "version": "5.6.9 and below" }, { "status": "affected", "version": "6.0.5 and below" }, { "status": "affected", "version": "6.2.0" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2019-6693", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json", "fetchedAt": "2026-10-24T04:46:56.988Z", "publishedAt": "2019-11-21T15:08:05.000Z", "modifiedAt": "2026-08-04T03:55:51.284Z", "state": "published", "provider": "fortinet", "title": "", "descriptions": [ { "lang": "en", "value": "Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Fortinet", "product": "FortiGate", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "5.6.9 and below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "6.0.5 and below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "6.2.0", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Information disclosure", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/2/cvssV3_1" } ], "references": [ { "url": "https://fortiguard.com/advisory/FG-IR-19-007", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6693", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"FortiGate\",\"vendor\":\"Fortinet\",\"versions\":[{\"status\":\"affected\",\"version\":\"5.6.9 and below\"},{\"status\":\"affected\",\"version\":\"6.0.5 and below\"},{\"status\":\"affected\",\"version\":\"6.2.0\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Information disclosure\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/2/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json", "sourcePath": "/containers/adp/1/metrics/2/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":6.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2019-6693:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "sourcePath": "retained:/originalText", "text": "Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2019-6693:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "modifiedAt": "2025-06-25T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-04T03:55:51.284Z", "fetchedAt": "2026-10-24T04:46:56.988Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-06-25T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "FortiGateに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:46:56.988Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "fa2a1ff8ce7a3c1c376367e17d1ddf93e6134fc83e88987807f2a6f258c0f475", "sourceModifiedAt": "2026-08-04T03:55:51.284Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "FortiOS の設定バックアップファイルでハードコードされた暗号鍵が使用されており、攻撃者がバックアップファイルにアクセスし、ハードコード鍵を知っている場合、機密データを復号できる可能性があります。機密データには、管理者以外のユーザーのパスワード、プライベートキーのパスフレーズ、設定されている場合の高可用性パスワードが含まれます。", "risk": "機密データが復号されることで、ユーザーのパスワードやプライベートキーのパスフレーズ、高可用性パスワードが漏洩する情報開示のリスクがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者が FortiOS の設定バックアップファイルにアクセスでき、かつハードコードされた暗号鍵の情報を知っていることが前提条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Fortinet / FortiGate。影響ありとして記載：5.6.9 and below。影響ありとして記載：6.0.5 and below。影響ありとして記載：6.2.0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json" ], "evidenceIds": [ "E2" ] }, { "text": "「FortiGate」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-6693", "https://fortiguard.com/advisory/FG-IR-19-007", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "https://nvd.nist.gov/vuln/detail/CVE-2019-6693" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2019-6693", "https://fortiguard.com/advisory/FG-IR-19-007", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "https://nvd.nist.gov/vuln/detail/CVE-2019-6693" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-6693", "https://fortiguard.com/advisory/FG-IR-19-007", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "https://nvd.nist.gov/vuln/detail/CVE-2019-6693" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-6693", "label": "CVE公式レコード" }, { "url": "https://fortiguard.com/advisory/FG-IR-19-007", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6693", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/6xxx/CVE-2019-6693.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"FortiGate\",\"vendor\":\"Fortinet\",\"versions\":[{\"status\":\"affected\",\"version\":\"5.6.9 and below\"},{\"status\":\"affected\",\"version\":\"6.0.5 and below\"},{\"status\":\"affected\",\"version\":\"6.2.0\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2019-6693\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2019-6693（FortiGate）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者が FortiOS の設定バックアップファイルにアクセスでき、かつハードコードされた暗号鍵の情報を知っていることが前提条件です。\n・公式の対象表：Fortinet / FortiGate。影響ありとして記載：5.6.9 and below。影響ありとして記載：6.0.5 and below。影響ありとして記載：6.2.0。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2019-6693", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:56.988Z", "lastSuccess": "2026-10-24T04:46:56.988Z", "sourceCheckedAt": "2026-10-24T04:46:56.988Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-0769", "aliases": [], "title": "DIR-859：ファイルへの不正アクセス", "summary": "D-Link DIR-859 の /hedwig.cgi にある HTTP POST Request Handler で、service パラメータに「../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml」を送信するとパス・トラバーサルが発生し、リモートから攻撃できる。", "risk": "この脆弱性によりセッションデータが漏洩し、特権昇格やデバイスの不正操作が可能になる可能性がある。", "product": "DIR-859", "category": "other", "component": "package", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "VulDB", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "DIR-859", "range": "1.06B01（機能: HTTP POST Request Handler）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "label": "CVE：VulDB" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-0769", "label": "CVE公式レコード" }, { "url": "https://vuldb.com/?id.251666", "label": "CVE掲載の参考情報" }, { "url": "https://vuldb.com/?ctiid.251666", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md", "label": "CVE掲載の参考情報" }, { "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0769", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-01-21T08:00:05.383Z", "modifiedAt": "2025-10-21T23:05:27.747Z", "fetchedAt": "2026-10-24T04:46:59.713Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.", "sourceTitle": "D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "D-Link", "product": "DIR-859", "versions": [ { "version": "1.06B01", "status": "affected" } ], "modules": [ "HTTP POST Request Handler" ] } ], "configurationNotes": "対象環境・機能: HTTP POST Request Handler。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-0769", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "fetchedAt": "2026-10-24T04:46:59.713Z", "publishedAt": "2024-01-21T08:00:05.383Z", "modifiedAt": "2025-10-21T23:05:27.747Z", "state": "published", "provider": "VulDB", "title": "D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal", "descriptions": [ { "lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "de", "value": "Eine kritische Schwachstelle wurde in D-Link DIR-859 1.06B01 ausgemacht. Es geht hierbei um eine nicht näher spezifizierte Funktion der Datei /hedwig.cgi der Komponente HTTP POST Request Handler. Durch Manipulieren des Arguments service mit der Eingabe ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.", "sourcePath": "/containers/cna/descriptions/1/value" }, { "lang": "en", "value": "D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "D-Link", "product": "DIR-859", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [ "HTTP POST Request Handler" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "1.06B01", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Path Traversal", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "VulDB", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" }, { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "VulDB", "sourcePath": "/containers/cna/metrics/1/cvssV3_0" }, { "version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "baseScore": 5, "baseSeverity": "", "provider": "VulDB", "sourcePath": "/containers/cna/metrics/2/cvssV2_0" } ], "references": [ { "url": "https://vuldb.com/?id.251666", "label": "CVE", "tags": [ "vdb-entry", "technical-description", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://vuldb.com/?ctiid.251666", "label": "CVE", "tags": [ "signature", "permissions-required", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md", "label": "CVE", "tags": [ "exploit", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371", "label": "CVE", "tags": [ "related", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0769", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0769", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"D-Link\",\"product\":\"DIR-859\",\"versions\":[{\"version\":\"1.06B01\",\"status\":\"affected\"}],\"modules\":[\"HTTP POST Request Handler\"]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/descriptions/1/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "sourcePath": "/containers/cna/descriptions/1/value", "text": "Eine kritische Schwachstelle wurde in D-Link DIR-859 1.06B01 ausgemacht. Es geht hierbei um eine nicht näher spezifizierte Funktion der Datei /hedwig.cgi der Komponente HTTP POST Request Handler. Durch Manipulieren des Arguments service mit der Eingabe ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"CWE\",\"cweId\":\"CWE-22\",\"lang\":\"en\",\"description\":\"CWE-22 Path Traversal\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":5.3,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/1/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "sourcePath": "/containers/cna/metrics/1/cvssV3_0", "text": "{\"version\":\"3.0\",\"baseScore\":5.3,\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/2/cvssV2_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "sourcePath": "/containers/cna/metrics/2/cvssV2_0", "text": "{\"version\":\"2.0\",\"baseScore\":5,\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-0769:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "sourcePath": "retained:/originalText", "text": "D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-0769:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "modifiedAt": "2025-06-25T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:27.747Z", "fetchedAt": "2026-10-24T04:46:59.713Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-06-25T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "DIR-859にファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:46:59.713Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "243342d1799eb03d3eb33e2d3dda56bb202d2667a6dbd0fe4b43ec1ea7ab654d", "sourceModifiedAt": "2025-10-21T23:05:27.747Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "D-Link DIR-859 の /hedwig.cgi にある HTTP POST Request Handler で、service パラメータに「../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml」を送信するとパス・トラバーサルが発生し、リモートから攻撃できる。", "risk": "この脆弱性によりセッションデータが漏洩し、特権昇格やデバイスの不正操作が可能になる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "攻撃者はネットワーク経由でリモートから HTTP POST リクエストを送信できる必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "対象は D-Link DIR-859 の /hedwig.cgi の HTTP POST Request Handler の機能である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃は service 引数に「../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml」を含めて実行される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "本製品はベンダーによりサポート終了（EOL）とされており、使用継続は推奨されない。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：D-Link / DIR-859。影響ありとして記載：1.06B01。対象の機能：HTTP POST Request Handler", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json" ], "evidenceIds": [ "E4" ] }, { "text": "「DIR-859」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-0769", "https://vuldb.com/?id.251666", "https://vuldb.com/?ctiid.251666", "https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md", "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "https://nvd.nist.gov/vuln/detail/CVE-2024-0769" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-0769", "https://vuldb.com/?id.251666", "https://vuldb.com/?ctiid.251666", "https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md", "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "https://nvd.nist.gov/vuln/detail/CVE-2024-0769" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-0769", "https://vuldb.com/?id.251666", "https://vuldb.com/?ctiid.251666", "https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md", "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "https://nvd.nist.gov/vuln/detail/CVE-2024-0769" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "label": "CVE：VulDB" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-0769", "label": "CVE公式レコード" }, { "url": "https://vuldb.com/?id.251666", "label": "CVE掲載の参考情報" }, { "url": "https://vuldb.com/?ctiid.251666", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md", "label": "CVE掲載の参考情報" }, { "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0769", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "sourceField": "/containers/cna/title", "excerpt": "D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "sourceField": "retained:/originalText", "excerpt": "D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/0xxx/CVE-2024-0769.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"D-Link\",\"product\":\"DIR-859\",\"versions\":[{\"version\":\"1.06B01\",\"status\":\"affected\"}],\"modules\":[\"HTTP POST Request Handler\"]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0769", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-0769\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-0769（DIR-859）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者はネットワーク経由でリモートから HTTP POST リクエストを送信できる必要がある。\n・対象は D-Link DIR-859 の /hedwig.cgi の HTTP POST Request Handler の機能である。\n・攻撃は service 引数に「../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml」を含めて実行される。\n・本製品はベンダーによりサポート終了（EOL）とされており、使用継続は推奨されない。\n・公式の対象表：D-Link / DIR-859。影響ありとして記載：1.06B01。対象の機能：HTTP POST Request Handler\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-0769", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:46:59.713Z", "lastSuccess": "2026-10-24T04:46:59.713Z", "sourceCheckedAt": "2026-10-24T04:46:59.713Z", "errorCode": null }, "glossary": [ { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" } ] } }, { "id": "CVE-2024-54085", "aliases": [], "title": "MegaRAC-SPx：認証の回避", "summary": "AMIのMegaRAC SPxのBMCにおいて、攻撃者がRedfishホストインターフェースを通じてリモートで認証を回避できる脆弱性が存在します。", "risk": "この脆弱性が成功すると、機密性、完全性、可用性が失われる可能性があります。", "product": "MegaRAC-SPx", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "4.0", "cvssSource": "AMI", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "affected": [ { "product": "MegaRAC-SPx", "range": ">= 12.0 / < 12.7" }, { "product": "MegaRAC-SPx", "range": ">= 13.0 / < 13.5" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "label": "CVE：AMI" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-54085", "label": "CVE公式レコード" }, { "url": "https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf", "label": "CISAが示す関連情報" }, { "url": "https://security.netapp.com/advisory/ntap-20250328-0003/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54085", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-11T14:00:58.643Z", "modifiedAt": "2026-02-26T19:09:41.995Z", "fetchedAt": "2026-10-24T04:47:06.867Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "AMI’s SPx contains\na vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability.", "sourceTitle": "Redfish Authentication Bypass", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "MegaRAC-SPx", "vendor": "AMI", "versions": [ { "lessThan": "12.7", "status": "affected", "version": "12.0", "versionType": "RC" }, { "lessThan": "13.5", "status": "affected", "version": "13.0", "versionType": "RC" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-54085", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "fetchedAt": "2026-10-24T04:47:06.867Z", "publishedAt": "2025-03-11T14:00:58.643Z", "modifiedAt": "2026-02-26T19:09:41.995Z", "state": "published", "provider": "AMI", "title": "Redfish Authentication Bypass", "descriptions": [ { "lang": "en", "value": "AMI’s SPx contains\na vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "AMI", "product": "MegaRAC-SPx", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.0", "lessThan": "12.7", "versionType": "RC", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "13.0", "lessThan": "13.5", "versionType": "RC", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-290", "lang": "en", "description": "CWE-290 Authentication Bypass by Spoofing", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "AMI", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf", "label": "AMI", "tags": [], "provider": "AMI", "sourcePath": "/containers/cna/references/0" }, { "url": "https://security.netapp.com/advisory/ntap-20250328-0003/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54085", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-54085", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://www.bleepingcomputer.com/news/security/cisa-ami-megarac-bug-that-lets-hackers-brick-servers-now-actively-exploited/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" }, { "url": "https://www.networkworld.com/article/4013368/ami-megarac-authentication-bypass-flaw-is-being-exploitated-cisa-warns.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/4" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"MegaRAC-SPx\",\"vendor\":\"AMI\",\"versions\":[{\"lessThan\":\"12.7\",\"status\":\"affected\",\"version\":\"12.0\",\"versionType\":\"RC\"},{\"lessThan\":\"13.5\",\"status\":\"affected\",\"version\":\"13.0\",\"versionType\":\"RC\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "AMI’s SPx contains\na vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-290\",\"description\":\"CWE-290 Authentication Bypass by Spoofing\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"attackVector\":\"NETWORK\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"HIGH\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-54085:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "sourcePath": "retained:/originalText", "text": "AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-54085:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "modifiedAt": "2025-06-25T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:41.995Z", "fetchedAt": "2026-10-24T04:47:06.867Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-06-25T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "MegaRAC-SPxに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:47:06.867Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "6e2990a685d7ccbcb1e769f6bed8cfce7161b700c1471ab62f4ef045df0112fd", "sourceModifiedAt": "2026-02-26T19:09:41.995Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "AMIのMegaRAC SPxのBMCにおいて、攻撃者がRedfishホストインターフェースを通じてリモートで認証を回避できる脆弱性が存在します。", "risk": "この脆弱性が成功すると、機密性、完全性、可用性が失われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "リモートの攻撃者がRedfishホストインターフェースにアクセスでき、認証バイパスはSpoofingによって実行される環境。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json" ], "evidenceIds": [ "E1", "E4", "E2" ] }, { "text": "公式の対象表：AMI / MegaRAC-SPx。影響ありとして記載：12.0以上、12.7未満。影響ありとして記載：13.0以上、13.5未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json" ], "evidenceIds": [ "E5" ] }, { "text": "「MegaRAC-SPx」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-54085", "https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "https://security.netapp.com/advisory/ntap-20250328-0003/", "https://nvd.nist.gov/vuln/detail/CVE-2024-54085" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json" ], "evidenceIds": [ "E5" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-54085", "https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "https://security.netapp.com/advisory/ntap-20250328-0003/", "https://nvd.nist.gov/vuln/detail/CVE-2024-54085" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json" ], "evidenceIds": [ "E5" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-54085", "https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "https://security.netapp.com/advisory/ntap-20250328-0003/", "https://nvd.nist.gov/vuln/detail/CVE-2024-54085" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "label": "CVE：AMI" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-54085", "label": "CVE公式レコード" }, { "url": "https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf", "label": "CISAが示す関連情報" }, { "url": "https://security.netapp.com/advisory/ntap-20250328-0003/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54085", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "AMI’s SPx contains\na vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "sourceField": "/containers/cna/title", "excerpt": "Redfish Authentication Bypass", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "sourceField": "retained:/originalText", "excerpt": "AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"cweId\":\"CWE-290\",\"description\":\"CWE-290 Authentication Bypass by Spoofing\",\"lang\":\"en\",\"type\":\"CWE\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/54xxx/CVE-2024-54085.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"MegaRAC-SPx\",\"vendor\":\"AMI\",\"versions\":[{\"lessThan\":\"12.7\",\"status\":\"affected\",\"version\":\"12.0\",\"versionType\":\"RC\"},{\"lessThan\":\"13.5\",\"status\":\"affected\",\"version\":\"13.0\",\"versionType\":\"RC\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-54085\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-54085（MegaRAC-SPx）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの攻撃者がRedfishホストインターフェースにアクセスでき、認証バイパスはSpoofingによって実行される環境。\n・公式の対象表：AMI / MegaRAC-SPx。影響ありとして記載：12.0以上、12.7未満。影響ありとして記載：13.0以上、13.5未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-54085", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:47:06.867Z", "lastSuccess": "2026-10-24T04:47:06.867Z", "sourceCheckedAt": "2026-10-24T04:47:06.867Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-0386", "aliases": [], "title": "Kernel：脆弱性情報", "summary": "Linux カーネルの OverlayFS サブシステムで、nosuid マウントから別のマウントへ能力付きファイルをコピーする際に、setuid ビットが付いたファイルの実行への不正アクセスが可能になる欠陥がある。この UID マッピングバグにより、ローカルユーザーがシステム上で権限をエスカレートできる。", "risk": "ローカルユーザーが特権ユーザーに昇格し、システム上で本来許可されていない操作が可能になる。", "product": "Kernel", "category": "linux", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "redhat", "cvssVector": null, "affected": [ { "product": "Kernel", "range": "Linux kernel 6.2-rc6" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json", "label": "CVE：redhat" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-0386", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a", "label": "CISAが示す関連情報" }, { "url": "https://security.netapp.com/advisory/ntap-20230420-0004/", "label": "CISAが示す関連情報" }, { "url": "https://www.debian.org/security/2023/dsa-5402", "label": "DSA-5402" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html", "label": "[debian-lts-announce] 20230605 [SECURITY] [DLA 3446-1] linux-5.10 security update" }, { "url": "http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html", "label": "CVE掲載の参考情報" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "label": "[debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security update" }, { "url": "https://access.redhat.com/security/cve/cve-2023-0386", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0386", "label": "CISAが示す関連情報" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2023-03-22T00:00:00.000Z", "modifiedAt": "2025-10-21T23:15:22.744Z", "fetchedAt": "2026-10-24T04:47:07.349Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "Kernel", "versions": [ { "version": "Linux kernel 6.2-rc6", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-0386", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json", "fetchedAt": "2026-10-24T04:47:07.349Z", "publishedAt": "2023-03-22T00:00:00.000Z", "modifiedAt": "2025-10-21T23:15:22.744Z", "state": "published", "provider": "redhat", "title": "", "descriptions": [ { "lang": "en", "value": "A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "Kernel", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "Linux kernel 6.2-rc6", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-282", "lang": "en", "description": "CWE-282", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://security.netapp.com/advisory/ntap-20230420-0004/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.debian.org/security/2023/dsa-5402", "label": "DSA-5402", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html", "label": "[debian-lts-announce] 20230605 [SECURITY] [DLA 3446-1] linux-5.10 security update", "tags": [ "mailing-list", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "label": "[debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security update", "tags": [ "mailing-list", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0386", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"Kernel\",\"versions\":[{\"version\":\"Linux kernel 6.2-rc6\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"CWE\",\"lang\":\"en\",\"description\":\"CWE-282\",\"cweId\":\"CWE-282\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.8,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-0386:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386", "sourcePath": "retained:/originalText", "text": "Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-0386:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386", "modifiedAt": "2025-06-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:15:22.744Z", "fetchedAt": "2026-10-24T04:47:07.349Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-06-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Kernelに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:47:07.349Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "763cf7a2cd530b7b83b0d22228bfed9ae1b3a6a61447283eacd3e728d8745113", "sourceModifiedAt": "2025-10-21T23:15:22.744Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Linux カーネルの OverlayFS サブシステムで、nosuid マウントから別のマウントへ能力付きファイルをコピーする際に、setuid ビットが付いたファイルの実行への不正アクセスが可能になる欠陥がある。この UID マッピングバグにより、ローカルユーザーがシステム上で権限をエスカレートできる。", "risk": "ローカルユーザーが特権ユーザーに昇格し、システム上で本来許可されていない操作が可能になる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "ローカルユーザーが nosuid マウント上の能力付きファイルを OverlayFS を介して別のマウントへコピーできる環境。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Kernel。影響ありとして記載：Linux kernel 6.2-rc6。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json" ], "evidenceIds": [ "E3" ] }, { "text": "管理担当者に、Linuxの種類（Ubuntu、Red Hatなど）と版、対象パッケージ名、配布元を含む完全なパッケージ番号を確認してもらいます。OSの種類や製品の上流の番号だけで、影響の有無を決めないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新が用意されていない場合は、配布元や保守会社へCVE番号とパッケージ番号を送り、影響の有無・回避策・提供予定を確認します。他のLinux向けの修正をそのまま入れないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json" ], "evidenceIds": [ "E3" ] }, { "text": "修正後の完全なパッケージ番号と、その配布元のCVE対応表を照合します。古い番号のまま修正を取り込む場合があるため、数字が小さいという理由だけで未修正とは扱いません。管理者に必要な再起動の完了も確認してもらってください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json", "label": "CVE：redhat" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-0386", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a", "label": "CISAが示す関連情報" }, { "url": "https://security.netapp.com/advisory/ntap-20230420-0004/", "label": "CISAが示す関連情報" }, { "url": "https://www.debian.org/security/2023/dsa-5402", "label": "DSA-5402" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html", "label": "[debian-lts-announce] 20230605 [SECURITY] [DLA 3446-1] linux-5.10 security update" }, { "url": "http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html", "label": "CVE掲載の参考情報" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "label": "[debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security update" }, { "url": "https://access.redhat.com/security/cve/cve-2023-0386", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0386", "label": "CISAが示す関連情報" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386", "sourceField": "retained:/originalText", "excerpt": "Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0386.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"Kernel\",\"versions\":[{\"version\":\"Linux kernel 6.2-rc6\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-0386\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-0386（Kernel）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ローカルユーザーが nosuid マウント上の能力付きファイルを OverlayFS を介して別のマウントへコピーできる環境。\n・公式の対象表：Kernel。影響ありとして記載：Linux kernel 6.2-rc6。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-0386", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:47:07.349Z", "lastSuccess": "2026-10-24T04:47:07.349Z", "sourceCheckedAt": "2026-10-24T04:47:07.349Z", "errorCode": null }, "glossary": [] } } ], "total": 2238, "limit": 20, "offset": 820, "filters": { "product": "all", "type": "all", "q": "", "page": 42 }, "pagination": { "page": 42, "pageSize": 20, "totalPages": 112 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-24T09:17:49.865Z", "lastAttempt": "2026-10-24T09:17:49.865Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-24T09:17:49.865Z", "lastAttempt": "2026-10-24T09:17:49.865Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-24T09:17:49.865Z", "lastAttempt": "2026-10-24T09:17:49.865Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-24T09:17:49.865Z", "lastAttempt": "2026-10-24T09:17:49.865Z", "error": null, "recordCount": 1, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-24T08:02:50.152Z 〜 2026-10-24T09:17:49.865Z、全製品の変更 16/16件まで確認、対象1件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-24T09:17:49.865Z", "lastAttempt": "2026-10-24T09:17:49.865Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }