{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2019-9874", "aliases": [], "title": "n/a：コード実行", "summary": "Sitecore CMS 7.0 から 7.2、Sitecore Experience Platform (XP) 7.5 から 8.2 の Sitecore.Security.AntiCSRF（アンチ CSRF）モジュールで、信頼できないデータの逆シリアル化が可能となり、認証されていない攻撃者が HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信することで任意のコードを実行できる。", "risk": "認証されていない攻撃者が任意のコードを実行できるため、サーバー上で攻撃者の意図した処理が行われる可能性がある。", "product": "Sitecore CMS and Experience Platform (XP)", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-9874", "label": "CVE公式レコード" }, { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE掲載の参考情報" }, { "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9874", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2019-05-31T20:11:49.000Z", "modifiedAt": "2025-10-21T23:45:35.994Z", "fetchedAt": "2026-10-24T04:53:05.945Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2019-9874", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "fetchedAt": "2026-10-24T04:53:05.945Z", "publishedAt": "2019-05-31T20:11:49.000Z", "modifiedAt": "2025-10-21T23:45:35.994Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9874", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2019-9874:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "sourcePath": "retained:/originalText", "text": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2019-9874:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "modifiedAt": "2025-03-26T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:45:35.994Z", "fetchedAt": "2026-10-24T04:53:05.945Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-26T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:05.945Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "330db264fe1c62d7a9238f9e0d5bca367e87fced53f83682eb91cae00b2982ef", "sourceModifiedAt": "2025-10-21T23:45:35.994Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Sitecore CMS 7.0 から 7.2、Sitecore Experience Platform (XP) 7.5 から 8.2 の Sitecore.Security.AntiCSRF（アンチ CSRF）モジュールで、信頼できないデータの逆シリアル化が可能となり、認証されていない攻撃者が HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信することで任意のコードを実行できる。", "risk": "認証されていない攻撃者が任意のコードを実行できるため、サーバー上で攻撃者の意図した処理が行われる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象製品は Sitecore CMS バージョン 7.0 から 7.2、Sitecore Experience Platform (XP) バージョン 7.5 から 8.2 である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者は認証されていない状態で、HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信できる必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Sitecore CMS and Experience Platform (XP)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-9874", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035", "https://nvd.nist.gov/vuln/detail/CVE-2019-9874" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2019-9874", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035", "https://nvd.nist.gov/vuln/detail/CVE-2019-9874" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-9874", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035", "https://nvd.nist.gov/vuln/detail/CVE-2019-9874" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-9874", "label": "CVE公式レコード" }, { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE掲載の参考情報" }, { "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9874", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "sourceField": "retained:/originalText", "excerpt": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9874.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9874", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2019-9874\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2019-9874（Sitecore CMS and Experience Platform (XP)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は Sitecore CMS バージョン 7.0 から 7.2、Sitecore Experience Platform (XP) バージョン 7.5 から 8.2 である。\n・攻撃者は認証されていない状態で、HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信できる必要がある。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2019-9874", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:05.945Z", "lastSuccess": "2026-10-24T04:53:05.945Z", "sourceCheckedAt": "2026-10-24T04:53:05.945Z", "errorCode": null }, "glossary": [ { "term": "CSRF", "meaning": "ログイン中の人のブラウザーを利用して、その人が意図しない操作をサイトへ送らせる問題です。本人の操作やログインが必要かは、個別の条件を確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF", "kind": "general_definition" }, { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" }, { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2019-9875", "aliases": [], "title": "n/a：コード実行", "summary": "Sitecore の anti‑CSRF モジュールにおける信頼できないデータの逆シリアル化により、認証済みの攻撃者が HTTP POST パラメータにシリアライズされた .NET オブジェクトを送信するだけで任意のコードを実行できる脆弱性が、9.1 以前のバージョンで存在します。", "risk": "攻撃者はサーバー上で任意のコードを実行させられます。", "product": "Sitecore CMS and Experience Platform (XP)", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-9875", "label": "CVE公式レコード" }, { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE掲載の参考情報" }, { "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9875", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2019-05-31T20:34:46.000Z", "modifiedAt": "2025-10-21T23:45:35.858Z", "fetchedAt": "2026-10-24T06:05:53.194Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2019-9875", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "fetchedAt": "2026-10-24T06:05:53.194Z", "publishedAt": "2019-05-31T20:34:46.000Z", "modifiedAt": "2025-10-21T23:45:35.858Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9875", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2019-9875:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "sourcePath": "retained:/originalText", "text": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2019-9875:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "modifiedAt": "2025-03-26T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:45:35.858Z", "fetchedAt": "2026-10-24T06:05:53.194Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-26T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:05:53.194Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "67045443df5a23d858dad5040b8d474a8489c32c24d709376b9c254035826902", "sourceModifiedAt": "2025-10-21T23:45:35.858Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Sitecore の anti‑CSRF モジュールにおける信頼できないデータの逆シリアル化により、認証済みの攻撃者が HTTP POST パラメータにシリアライズされた .NET オブジェクトを送信するだけで任意のコードを実行できる脆弱性が、9.1 以前のバージョンで存在します。", "risk": "攻撃者はサーバー上で任意のコードを実行させられます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象は Sitecore CMS および Experience Platform (XP) の anti‑CSRF モジュール (Sitecore.Security.AntiCSRF) で、攻撃者が認証済みであり、HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信できる環境です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Sitecore CMS and Experience Platform (XP)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-9875", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556", "https://nvd.nist.gov/vuln/detail/CVE-2019-9875" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2019-9875", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556", "https://nvd.nist.gov/vuln/detail/CVE-2019-9875" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-9875", "https://dev.sitecore.net/Downloads.aspx", "https://www.synacktiv.com/blog.html", "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556", "https://nvd.nist.gov/vuln/detail/CVE-2019-9875" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-9875", "label": "CVE公式レコード" }, { "url": "https://dev.sitecore.net/Downloads.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/blog.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf", "label": "CVE掲載の参考情報" }, { "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9875", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "sourceField": "retained:/originalText", "excerpt": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/9xxx/CVE-2019-9875.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2019-9875\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2019-9875（Sitecore CMS and Experience Platform (XP)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Sitecore CMS および Experience Platform (XP) の anti‑CSRF モジュール (Sitecore.Security.AntiCSRF) で、攻撃者が認証済みであり、HTTP POST パラメータ __CSRFTOKEN にシリアライズされた .NET オブジェクトを送信できる環境です。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2019-9875", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:05:53.194Z", "lastSuccess": "2026-10-24T06:05:53.194Z", "sourceCheckedAt": "2026-10-24T06:05:53.194Z", "errorCode": null }, "glossary": [ { "term": "CSRF", "meaning": "ログイン中の人のブラウザーを利用して、その人が意図しない操作をサイトへ送らせる問題です。本人の操作やログインが必要かは、個別の条件を確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF", "kind": "general_definition" }, { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" }, { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-30154", "aliases": [], "title": "reviewdog：脆弱性情報", "summary": "reviewdog/action-setup@v1 が 2025 年 3 月 11 日 18:42〜20:31 UTC の間に改ざんされ、悪意のあるコードが追加されてシークレットが Github Actions のワークフローログに出力されました。また、reviewdog/action-setup@v1 を使用する reviewdog/action-shellcheck、reviewdog/action-composite-template、reviewdog/action-staticcheck、reviewdog/action-ast-grep、reviewdog/action-typos も同様に影響を受けます。", "risk": "悪意のあるコードにより、露出したシークレットが Github Actions のワークフローログに書き出されます。", "product": "reviewdog", "category": "other", "component": "package", "severity": "high", "cvss": 8.6, "cvssVersion": "3.1", "cvssSource": "GitHub_M", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "reviewdog", "range": "= 1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30154", "label": "CVE公式レコード" }, { "url": "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "label": "CISAが示す関連情報" }, { "url": "https://github.com/reviewdog/reviewdog/issues/2079", "label": "https://github.com/reviewdog/reviewdog/issues/2079" }, { "url": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "label": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887" }, { "url": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "label": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec" }, { "url": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "label": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30154", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-19T15:15:29.113Z", "modifiedAt": "2026-02-26T19:09:21.840Z", "fetchedAt": "2026-10-24T04:53:13.677Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.", "sourceTitle": "Multiple Reviewdog actions were compromised during a specific time period", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "reviewdog", "product": "reviewdog", "versions": [ { "version": "= 1", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-30154", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "fetchedAt": "2026-10-24T04:53:13.677Z", "publishedAt": "2025-03-19T15:15:29.113Z", "modifiedAt": "2026-02-26T19:09:21.840Z", "state": "published", "provider": "GitHub_M", "title": "Multiple Reviewdog actions were compromised during a specific time period", "descriptions": [ { "lang": "en", "value": "reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "reviewdog", "product": "reviewdog", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "= 1", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-506", "lang": "en", "description": "CWE-506: Embedded Malicious Code", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "provider": "GitHub_M", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "label": "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "tags": [ "x_refsource_CONFIRM" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/reviewdog/reviewdog/issues/2079", "label": "https://github.com/reviewdog/reviewdog/issues/2079", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "label": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/2" }, { "url": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "label": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/3" }, { "url": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "label": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/4" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30154", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"reviewdog\",\"product\":\"reviewdog\",\"versions\":[{\"version\":\"= 1\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-506\",\"lang\":\"en\",\"description\":\"CWE-506: Embedded Malicious Code\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-30154:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "sourcePath": "retained:/originalText", "text": "reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-30154:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "modifiedAt": "2025-03-24T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:21.840Z", "fetchedAt": "2026-10-24T04:53:13.677Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-24T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "reviewdogに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:13.677Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "67ca75843c2d539537d630e0b0422ce263b82a66156d1540a6b269943763230c", "sourceModifiedAt": "2026-02-26T19:09:21.840Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "reviewdog/action-setup@v1 が 2025 年 3 月 11 日 18:42〜20:31 UTC の間に改ざんされ、悪意のあるコードが追加されてシークレットが Github Actions のワークフローログに出力されました。また、reviewdog/action-setup@v1 を使用する reviewdog/action-shellcheck、reviewdog/action-composite-template、reviewdog/action-staticcheck、reviewdog/action-ast-grep、reviewdog/action-typos も同様に影響を受けます。", "risk": "悪意のあるコードにより、露出したシークレットが Github Actions のワークフローログに書き出されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "GitHub Actions のワークフローで reviewdog/action-setup@v1 が使用されている場合、当該バージョンが 2025 年 3 月 11 日 18:42〜20:31 UTC の間に改ざんされたことにより、シークレットがログに漏洩します。さらに、reviewdog/action-setup@v1 を参照する reviewdog の他のアクション（action-shellcheck、action-composite-template、action-staticcheck、action-ast-grep、action-typos）もバージョンやピン止め方法に関わらず同様に影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：reviewdog / reviewdog。影響ありとして記載：= 1。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json" ], "evidenceIds": [ "E4" ] }, { "text": "「reviewdog」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30154", "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "https://github.com/reviewdog/reviewdog/issues/2079", "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://nvd.nist.gov/vuln/detail/CVE-2025-30154" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-30154", "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "https://github.com/reviewdog/reviewdog/issues/2079", "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://nvd.nist.gov/vuln/detail/CVE-2025-30154" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30154", "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "https://github.com/reviewdog/reviewdog/issues/2079", "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://nvd.nist.gov/vuln/detail/CVE-2025-30154" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30154", "label": "CVE公式レコード" }, { "url": "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc", "label": "CISAが示す関連情報" }, { "url": "https://github.com/reviewdog/reviewdog/issues/2079", "label": "https://github.com/reviewdog/reviewdog/issues/2079" }, { "url": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887", "label": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887" }, { "url": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec", "label": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec" }, { "url": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "label": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30154", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourceField": "/containers/cna/title", "excerpt": "Multiple Reviewdog actions were compromised during a specific time period", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "sourceField": "retained:/originalText", "excerpt": "reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30154.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"reviewdog\",\"product\":\"reviewdog\",\"versions\":[{\"version\":\"= 1\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-30154\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-30154（reviewdog）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・GitHub Actions のワークフローで reviewdog/action-setup@v1 が使用されている場合、当該バージョンが 2025 年 3 月 11 日 18:42〜20:31 UTC の間に改ざんされたことにより、シークレットがログに漏洩します。さらに、reviewdog/action-setup@v1 を参照する reviewdog の他のアクション（action-shellcheck、action-composite-template、action-staticcheck、action-ast-grep、action-typos）もバージョンやピン止め方法に関わらず同様に影響を受けます。\n・公式の対象表：reviewdog / reviewdog。影響ありとして記載：= 1。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-30154", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:13.677Z", "lastSuccess": "2026-10-24T04:53:13.677Z", "sourceCheckedAt": "2026-10-24T04:53:13.677Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2017-12637", "aliases": [], "title": "n/a：ファイルへの不正アクセス", "summary": "SAP NetWeaver Application Server Java の scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS にディレクトリトラバーサルの脆弱性があり、リモート攻撃者がクエリ文字列に \"..\" を入れることで任意のファイルを読み取れる。", "risk": "攻撃者が任意のファイルを取得できる。", "product": "SAP NetWeaver", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2017-12637", "label": "CVE公式レコード" }, { "url": "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "label": "CVE掲載の参考情報" }, { "url": "https://me.sap.com/notes/3476549", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12637", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2017-08-07T20:00:00.000Z", "modifiedAt": "2025-10-21T23:55:35.932Z", "fetchedAt": "2026-10-24T06:06:39.071Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2017-12637", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "fetchedAt": "2026-10-24T06:06:39.071Z", "publishedAt": "2017-08-07T20:00:00.000Z", "modifiedAt": "2025-10-21T23:55:35.932Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12637", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2017-12637:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "sourcePath": "retained:/originalText", "text": "SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2017-12637:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:55:35.932Z", "fetchedAt": "2026-10-24T06:06:39.071Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:06:39.071Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f9bed483eded0f0933ca8638bf63a01329892fde389da2fa47642e5e3289e7f8", "sourceModifiedAt": "2025-10-21T23:55:35.932Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SAP NetWeaver Application Server Java の scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS にディレクトリトラバーサルの脆弱性があり、リモート攻撃者がクエリ文字列に \"..\" を入れることで任意のファイルを読み取れる。", "risk": "攻撃者が任意のファイルを取得できる。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "リモートから \"..\" を含むクエリ文字列を送信できることが必要。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json" ], "evidenceIds": [ "E2" ] }, { "text": "「SAP NetWeaver」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2017-12637", "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "https://me.sap.com/notes/3476549", "https://nvd.nist.gov/vuln/detail/CVE-2017-12637" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2017-12637", "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "https://me.sap.com/notes/3476549", "https://nvd.nist.gov/vuln/detail/CVE-2017-12637" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2017-12637", "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "https://me.sap.com/notes/3476549", "https://nvd.nist.gov/vuln/detail/CVE-2017-12637" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2017-12637", "label": "CVE公式レコード" }, { "url": "https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/", "label": "CVE掲載の参考情報" }, { "url": "https://me.sap.com/notes/3476549", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12637", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2017/12xxx/CVE-2017-12637.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2017-12637\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2017-12637（SAP NetWeaver）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートから \"..\" を含むクエリ文字列を送信できることが必要。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2017-12637", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:06:39.071Z", "lastSuccess": "2026-10-24T06:06:39.071Z", "sourceCheckedAt": "2026-10-24T06:06:39.071Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-48248", "aliases": [], "title": "Backup & Replication Director：コード実行", "summary": "NAKIVO Backup & Replication のバージョン 11.0.0.88174 未満では、getImageByPath を介して /c/router へ絶対パスでファイルを読み取ることができ、PhysicalDiscovery が平文の認証情報を保持しているため、企業全体でリモートコード実行が可能になる恐れがあります。", "risk": "企業全体でリモートコード実行が可能になる恐れがある。", "product": "Backup & Replication Director", "category": "other", "component": "package", "severity": "high", "cvss": 8.6, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "Backup & Replication Director", "range": "< 11.0.0.88174" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-48248", "label": "CVE公式レコード" }, { "url": "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "label": "CVE掲載の参考情報" }, { "url": "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48248", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-04T00:00:00.000Z", "modifiedAt": "2025-10-21T22:55:28.559Z", "fetchedAt": "2026-10-24T04:53:15.427Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Backup & Replication Director", "vendor": "NAKIVO", "versions": [ { "lessThan": "11.0.0.88174", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-48248", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "fetchedAt": "2026-10-24T04:53:15.427Z", "publishedAt": "2025-03-04T00:00:00.000Z", "modifiedAt": "2025-10-21T22:55:28.559Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "NAKIVO", "product": "Backup & Replication Director", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "11.0.0.88174", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-36", "lang": "en", "description": "CWE-36 Absolute Path Traversal", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-48248", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Backup & Replication Director\",\"vendor\":\"NAKIVO\",\"versions\":[{\"lessThan\":\"11.0.0.88174\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-36\",\"description\":\"CWE-36 Absolute Path Traversal\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-48248:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "sourcePath": "retained:/originalText", "text": "NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-48248:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:28.559Z", "fetchedAt": "2026-10-24T04:53:15.427Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Backup & Replication Directorにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:15.427Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b3a23dc1de2d0618d3a19dbd082efd1d2b62943cd97ddbf70f99441347030460", "sourceModifiedAt": "2025-10-21T22:55:28.559Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "NAKIVO Backup & Replication のバージョン 11.0.0.88174 未満では、getImageByPath を介して /c/router へ絶対パスでファイルを読み取ることができ、PhysicalDiscovery が平文の認証情報を保持しているため、企業全体でリモートコード実行が可能になる恐れがあります。", "risk": "企業全体でリモートコード実行が可能になる恐れがある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者が getImageByPath 機能を利用し、/c/router など任意のパスを指定してファイルを読み取れる環境で、PhysicalDiscovery が平文の認証情報を保持している場合に成立する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：NAKIVO / Backup & Replication Director。影響ありとして記載：11.0.0.88174未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Backup & Replication Director」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-48248", "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "https://nvd.nist.gov/vuln/detail/CVE-2024-48248" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-48248", "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "https://nvd.nist.gov/vuln/detail/CVE-2024-48248" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-48248", "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "https://nvd.nist.gov/vuln/detail/CVE-2024-48248" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-48248", "label": "CVE公式レコード" }, { "url": "https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/", "label": "CVE掲載の参考情報" }, { "url": "https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48248", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48248.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Backup & Replication Director\",\"vendor\":\"NAKIVO\",\"versions\":[{\"lessThan\":\"11.0.0.88174\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-48248", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-48248\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-48248（Backup & Replication Director）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者が getImageByPath 機能を利用し、/c/router など任意のパスを指定してファイルを読み取れる環境で、PhysicalDiscovery が平文の認証情報を保持している場合に成立する。\n・公式の対象表：NAKIVO / Backup & Replication Director。影響ありとして記載：11.0.0.88174未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-48248", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:15.427Z", "lastSuccess": "2026-10-24T04:53:15.427Z", "sourceCheckedAt": "2026-10-24T04:53:15.427Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-1316", "aliases": [], "title": "IC-7100 IP Camera：コード実行", "summary": "Edimax IC-7100 はリクエストを適切に無害化できません。攻撃者は細工したリクエストを作成し、デバイス上でリモートコード実行を行わせることができます。", "risk": "この脆弱性が悪用されると、攻撃者はデバイス上で任意のコードを実行できるようになります。", "product": "IC-7100 IP Camera", "category": "other", "component": "package", "severity": "critical", "cvss": 9.3, "cvssVersion": "4.0", "cvssSource": "icscert", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "IC-7100 IP Camera", "range": "All" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "label": "CVE：icscert" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "label": "CVE掲載の参考情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1316", "label": "CVE公式レコード" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1316", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-04T23:36:59.724Z", "modifiedAt": "2025-10-21T22:55:25.794Z", "fetchedAt": "2026-10-24T04:53:18.637Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device", "sourceTitle": "Edimax IC-7100 IP Camera OS Command Injection", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "IC-7100 IP Camera", "vendor": "Edimax", "versions": [ { "status": "affected", "version": "All" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-1316", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "fetchedAt": "2026-10-24T04:53:18.637Z", "publishedAt": "2025-03-04T23:36:59.724Z", "modifiedAt": "2025-10-21T22:55:25.794Z", "state": "published", "provider": "icscert", "title": "Edimax IC-7100 IP Camera OS Command Injection", "descriptions": [ { "lang": "en", "value": "Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Edimax", "product": "IC-7100 IP Camera", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "All", "status": "affected" } ] } ], "solutions": [], "workarounds": [ { "lang": "en", "value": "Edimax has not responded to CISA requests to coordinate the vulnerability. Affected users are encouraged to reach out to Edimax customer support https://www.edimax.com/edimax/form/contact_us/data/edimax/global/contact_us/ .", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "icscert", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "icscert", "sourcePath": "/containers/cna/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "label": "icscert", "tags": [], "provider": "icscert", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1316", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"IC-7100 IP Camera\",\"vendor\":\"Edimax\",\"versions\":[{\"status\":\"affected\",\"version\":\"All\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "Edimax has not responded to CISA requests to coordinate the vulnerability. Affected users are encouraged to reach out to Edimax customer support https://www.edimax.com/edimax/form/contact_us/data/edimax/global/contact_us/ .", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-78\",\"description\":\"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"attackVector\":\"NETWORK\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"HIGH\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourcePath": "/containers/cna/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-1316:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "sourcePath": "retained:/originalText", "text": "Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-1316:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "linked:https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "sourcePath": "article:summary-vulnerabilities-remediations", "text": "Edimax IC-7100 IP Camera | CISA\n\n1. EXECUTIVE SUMMARY\n\nCVSS v4 9.3\n\nATTENTION : Exploitable remotely/low attack complexity/public exploits are available\n\nVendor : Edimax\n\nEquipment : IC-7100 IP Camera\n\nVulnerability : Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\n\n2. RISK EVALUATION\n\nSuccessful exploitation of this vulnerability could allow an attacker to send specially crafted requests to achieve remote code execution on the device.\n\n3. TECHNICAL DETAILS\n\n3.1 AFFECTED PRODUCTS\n\nThe following versions of Edimax products are affected:\n\nIC-7100 IP Camera: All versions\n\n3.2 VULNERABILITY OVERVIEW\n\n3.2.1 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78\n\nEdimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device\n\nCVE-2025-1316 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ).\n\nA CVSS v4 score has also been calculated for  CVE-2025-1316 . A base score of 9.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N ).\n\n3.3 BACKGROUND\n\nCRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities Sector\n\nCOUNTRIES/AREAS DEPLOYED: Worldwide\n\nCOMPANY HEADQUARTERS LOCATION: Taiwan\n\n3.4 RESEARCHER\n\nAkamai SIRT reported this vulnerability to CISA.\n\n4. MITIGATIONS\n\nEdimax has not responded to CISA requests to coordinate the vulnerability. Affected users are encouraged to reach out to Edimax customer support .\n\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:\n\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet .\n\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies .\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets .\n\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies .\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n5. UPDATE HISTORY\n\nMarch 4, 2025: Initial Publication\n\nThis product is provided subject to this Notification and this Privacy & Use policy.\n\nTags\n\nSector :\nCommercial Facilities Sector\n\nTopics :\nIndustrial Control System Vulnerabilities ,\nIndustrial Control Systems", "truncated": false, "representation": "html_text_excerpt", "relatedCve": "CVE-2025-1316", "relatedCves": [ "CVE-2025-1316" ] } ], "limits": { "completeness": "official_record_with_linked_advisories", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。 当該CVEを本文中に明記した、直接参照された公的機関・開発元の告知を追加しています。複数製品・CVEを含む告知の対策は、その製品・CVEとの対応関係を維持してください。", "excludedLinkedSources": [] }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true }, { "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "title": "Edimax IC-7100 IP Camera | CISA", "relatedCves": [ "CVE-2025-1316" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "title": "Edimax IC-7100 IP Camera | CISA", "relatedCves": [ "CVE-2025-1316" ], "truncated": false } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:25.794Z", "fetchedAt": "2026-10-24T04:53:18.637Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "IC-7100 IP Cameraにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:18.637Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ff763c19d5b02de4f8b265ed3cfbda2bc58591bb634cbdfc85bff8faff03e669", "sourceModifiedAt": "2025-10-21T22:55:25.794Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Edimax IC-7100 はリクエストを適切に無害化できません。攻撃者は細工したリクエストを作成し、デバイス上でリモートコード実行を行わせることができます。", "risk": "この脆弱性が悪用されると、攻撃者はデバイス上で任意のコードを実行できるようになります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "公式の対象表：Edimax / IC-7100 IP Camera。影響ありとして記載：All。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json" ], "evidenceIds": [ "E4" ] }, { "text": "「IC-7100 IP Camera」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-1316", "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/", "https://nvd.nist.gov/vuln/detail/CVE-2025-1316" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "Edimax は CISA の連絡に応答していません。影響を受けたユーザーは Edimax カスタマーサポートへ問い合わせることが推奨されています。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json" ], "evidenceIds": [ "E5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-1316", "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/", "https://nvd.nist.gov/vuln/detail/CVE-2025-1316" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "label": "CVE：icscert" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "label": "CVE掲載の参考情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1316", "label": "CVE公式レコード" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-1316", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.edimax.com/edimax/post/post/data/edimax/global/press_releases/4801/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1316", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourceField": "/containers/cna/title", "excerpt": "Edimax IC-7100 IP Camera OS Command Injection", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "Edimax IC-7100 IP Camera | CISA\n\n1. EXECUTIVE SUMMARY\n\nCVSS v4 9.3\n\nATTENTION : Exploitable remotely/low attack complexity/public exploits are available\n\nVendor : Edimax\n\nEquipment : IC-7100 IP Camera\n\nVulnerability : Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\n\n2. RISK EVALUATION\n\nSuccessful exploitation of this vulnerability could allow an attacker to send specially crafted requests to achieve remote code execution on the device.\n\n3. TECHNICAL DETAILS\n\n3.1 AFFECTED PRODUCTS\n\nThe following versions of Edimax products are affected:\n\nIC-7100 IP Camera: All versions\n\n3.2 VULNERABILITY OVERVIEW\n\n3.2.1 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78\n\nEdimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device\n\nCVE-2025-1316 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ).\n\nA CVSS v4 score has also been calculated for  CVE-2025-1316 . A base score of 9.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N ).\n\n3.3 BACKGROUND\n\nCRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities Sector\n\nCOUNTRIES/AREAS DEPLOYED: Worldwide\n\nCOMPANY HEADQUARTERS LOCATION: Taiwan\n\n3.4 RESEARCHER\n\nAkamai SIRT reported this vulnerability to CISA.\n\n4. MITIGATIONS\n\nEdimax has not responded to CISA requests to coordinate the vulnerability. Affected users are encouraged to reach out to Edimax customer support .\n\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:\n\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet .\n\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies .\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets .\n\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies .\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n5. UPDATE HISTORY\n\nMarch 4, 2025: Initial Publication\n\nThis product is provided subject to this Notification and this Privacy & Use policy.\n\nTags\n\nSector :\nCommercial Facilities Sector\n\nTopics :\nIndustrial Control System Vulnerabilities ,\nIndustrial Control Systems", "language": null, "representation": "html_text_excerpt" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"IC-7100 IP Camera\",\"vendor\":\"Edimax\",\"versions\":[{\"status\":\"affected\",\"version\":\"All\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1316.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "Edimax has not responded to CISA requests to coordinate the vulnerability. Affected users are encouraged to reach out to Edimax customer support https://www.edimax.com/edimax/form/contact_us/data/edimax/global/contact_us/ .", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-1316\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-1316（IC-7100 IP Camera）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Edimax / IC-7100 IP Camera。影響ありとして記載：All。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-1316", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:18.637Z", "lastSuccess": "2026-10-24T04:53:18.637Z", "sourceCheckedAt": "2026-10-24T04:53:18.637Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-24472", "aliases": [], "title": "FortiOS / FortiProxy：認証の回避", "summary": "FortiOS 7.0.0 から 7.0.16 および FortiProxy 7.2.0 から 7.2.12、7.0.0 から 7.0.19 のバージョンに影響する、認証バイパス（代替経路またはチャネル利用）脆弱性（CWE‑288）です。Security Fabric が有効化されている環境で、上流および下流デバイスのシリアル番号を事前に把握したリモートの未認証攻撃者が、細工した CSF プロキシリクエストを送信することで、下流デバイスのスーパ―管理者権限を取得できる可能性があります。", "risk": "この認証バイパスにより、リモート攻撃者が細工した CSF プロキシリクエストを使ってスーパ―管理者権限を取得できる可能性があります。", "product": "FortiOS / FortiProxy", "category": "other", "component": "package", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "fortinet", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C", "affected": [ { "product": "FortiOS", "range": ">= 7.0.0 / <= 7.0.16" }, { "product": "FortiProxy", "range": ">= 7.2.0 / <= 7.2.12" }, { "product": "FortiProxy", "range": ">= 7.0.0 / <= 7.0.19" } ], "fixed": [], "steps": [ "FortiOS をバージョン 7.0.17 以上にアップグレードする。FortiProxy をバージョン 7.2.13 以上、または 7.0.20 以上にアップグレードする。", "「CVE-2025-24472」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24472", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24472", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-02-11T16:50:42.207Z", "modifiedAt": "2026-08-05T03:56:00.893Z", "fetchedAt": "2026-10-24T04:53:21.610Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Fortinet", "product": "FortiOS", "cpes": [ "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.16", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiProxy", "cpes": [ "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.12", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.19", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-24472", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "fetchedAt": "2026-10-24T04:53:21.610Z", "publishedAt": "2025-02-11T16:50:42.207Z", "modifiedAt": "2026-08-05T03:56:00.893Z", "state": "published", "provider": "fortinet", "title": "", "descriptions": [ { "lang": "en", "value": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Fortinet", "product": "FortiOS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.0.0", "lessThanOrEqual": "7.0.16", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiProxy", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "7.2.0", "lessThanOrEqual": "7.2.12", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "7.0.0", "lessThanOrEqual": "7.0.19", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to FortiOS version 7.0.17 or above\nUpgrade to FortiProxy version 7.2.13 or above\nUpgrade to FortiProxy version 7.0.20 or above", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-288", "lang": "en", "description": "Execute unauthorized code or commands", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "fortinet", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "label": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "tags": [], "provider": "fortinet", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24472", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"cpes\":[\"cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.16\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiProxy\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.12\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.19\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Upgrade to FortiOS version 7.0.17 or above\nUpgrade to FortiProxy version 7.2.13 or above\nUpgrade to FortiProxy version 7.0.20 or above", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-288\",\"description\":\"Execute unauthorized code or commands\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-24472:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "sourcePath": "retained:/originalText", "text": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-24472:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "modifiedAt": "2025-03-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-05T03:56:00.893Z", "fetchedAt": "2026-10-24T04:53:21.610Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "FortiOS / FortiProxyに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:53:21.610Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a873d0867c9596879dca7fe09b182495d854a77a64abe9af2f85bb8a750c7127", "sourceModifiedAt": "2026-08-05T03:56:00.893Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "FortiOS 7.0.0 から 7.0.16 および FortiProxy 7.2.0 から 7.2.12、7.0.0 から 7.0.19 のバージョンに影響する、認証バイパス（代替経路またはチャネル利用）脆弱性（CWE‑288）です。Security Fabric が有効化されている環境で、上流および下流デバイスのシリアル番号を事前に把握したリモートの未認証攻撃者が、細工した CSF プロキシリクエストを送信することで、下流デバイスのスーパ―管理者権限を取得できる可能性があります。", "risk": "この認証バイパスにより、リモート攻撃者が細工した CSF プロキシリクエストを使ってスーパ―管理者権限を取得できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "リモートの未認証攻撃者が、上流および下流デバイスのシリアル番号を事前に把握し、Security Fabric が有効化されている環境で、細工した CSF プロキシリクエストを送信できることが条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.0.0以上、7.0.16以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Fortinet / FortiProxy。影響ありとして記載：7.2.0以上、7.2.12以下。影響ありとして記載：7.0.0以上、7.0.19以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E3" ] }, { "text": "「FortiOS / FortiProxy」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-24472", "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] } ], "actions": [ { "text": "FortiOS をバージョン 7.0.17 以上にアップグレードする。FortiProxy をバージョン 7.2.13 以上、または 7.0.20 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E5" ] }, { "text": "「CVE-2025-24472」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-24472", "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-24472", "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-24472", "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-24472", "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24472", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24472", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "sourceField": "retained:/originalText", "excerpt": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"cpes\":[\"cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.16\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiProxy\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.12\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.19\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24472.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Upgrade to FortiOS version 7.0.17 or above\nUpgrade to FortiProxy version 7.2.13 or above\nUpgrade to FortiProxy version 7.0.20 or above", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-24472\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-24472（FortiOS / FortiProxy）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの未認証攻撃者が、上流および下流デバイスのシリアル番号を事前に把握し、Security Fabric が有効化されている環境で、細工した CSF プロキシリクエストを送信できることが条件です。\n・公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.0.0以上、7.0.16以下。\n・公式の対象表：Fortinet / FortiProxy。影響ありとして記載：7.2.0以上、7.2.12以下。影響ありとして記載：7.0.0以上、7.0.19以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-24472", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:53:21.610Z", "lastSuccess": "2026-10-24T04:53:21.610Z", "sourceCheckedAt": "2026-10-24T04:53:21.610Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-30066", "aliases": [], "title": "changed-files：脆弱性情報", "summary": "tj-actions の changed-files バージョン 46 未満では、リモートの攻撃者がアクションのログを読み取ることでシークレットを発見できる脆弱性があります。タグ v1 から v45.0.7 までが 2025‑03‑14 と 2025‑03‑15 に脅威アクターによりコミット 0e58ed8（悪意ある updateFeatures コードを含む）を指すよう改ざんされたため影響を受けました。", "risk": "リモートの攻撃者が GitHub Actions のワークフローログを読み取ることで、AWS のアクセスキーや GitHub の個人アクセストークン、npm トークン、プライベート RSA 鍵などの機密情報を取得できる可能性があります。", "product": "changed-files", "category": "other", "component": "package", "severity": "high", "cvss": 8.6, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "changed-files", "range": ">= 1 / < 46" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30066", "label": "CVE公式レコード" }, { "url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/tj-actions/changed-files/issues/2463", "label": "CVE掲載の参考情報" }, { "url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "label": "CVE掲載の参考情報" }, { "url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=43368870", "label": "CVE掲載の参考情報" }, { "url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=43367987", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/rackerlabs/genestack/pull/903", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/chains-project/maven-lockfile/pull/1111", "label": "CVE掲載の参考情報" }, { "url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "label": "CISAが示す関連情報" }, { "url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30066", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-15T00:00:00.000Z", "modifiedAt": "2026-02-26T19:09:29.628Z", "fetchedAt": "2026-10-24T04:55:52.951Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "changed-files", "vendor": "tj-actions", "versions": [ { "lessThan": "46", "status": "affected", "version": "1", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-30066", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "fetchedAt": "2026-10-24T04:55:52.951Z", "publishedAt": "2025-03-15T00:00:00.000Z", "modifiedAt": "2026-02-26T19:09:29.628Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "tj-actions", "product": "changed-files", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "1", "lessThan": "46", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-506", "lang": "en", "description": "CWE-506 Embedded Malicious Code", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/tj-actions/changed-files/issues/2463", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/2" }, { "url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/3" }, { "url": "https://news.ycombinator.com/item?id=43368870", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/4" }, { "url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/5" }, { "url": "https://news.ycombinator.com/item?id=43367987", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/6" }, { "url": "https://github.com/rackerlabs/genestack/pull/903", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/7" }, { "url": "https://github.com/chains-project/maven-lockfile/pull/1111", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/8" }, { "url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/9" }, { "url": "https://github.com/espressif/arduino-esp32/issues/11127", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/10" }, { "url": "https://github.com/modal-labs/modal-examples/issues/1100", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/11" }, { "url": "https://github.com/tj-actions/changed-files/issues/2464", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/12" }, { "url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/13" }, { "url": "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/14" }, { "url": "https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/15" }, { "url": "https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/16" }, { "url": "https://github.com/tj-actions/changed-files/issues/2477", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/17" }, { "url": "https://blog.gitguardian.com/compromised-tj-actions/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/18" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"changed-files\",\"vendor\":\"tj-actions\",\"versions\":[{\"lessThan\":\"46\",\"status\":\"affected\",\"version\":\"1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-506\",\"description\":\"CWE-506 Embedded Malicious Code\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-30066:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "sourcePath": "retained:/originalText", "text": "tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-30066:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "modifiedAt": "2025-03-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:29.628Z", "fetchedAt": "2026-10-24T04:55:52.951Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "changed-filesに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:55:52.951Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ce232813d1d93cffb79e059b1550440c8e402f10a700104d312bf9f9077f9f4d", "sourceModifiedAt": "2026-02-26T19:09:29.628Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "tj-actions の changed-files バージョン 46 未満では、リモートの攻撃者がアクションのログを読み取ることでシークレットを発見できる脆弱性があります。タグ v1 から v45.0.7 までが 2025‑03‑14 と 2025‑03‑15 に脅威アクターによりコミット 0e58ed8（悪意ある updateFeatures コードを含む）を指すよう改ざんされたため影響を受けました。", "risk": "リモートの攻撃者が GitHub Actions のワークフローログを読み取ることで、AWS のアクセスキーや GitHub の個人アクセストークン、npm トークン、プライベート RSA 鍵などの機密情報を取得できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "リモートの攻撃者が GitHub Actions のワークフローログを読み取ることができる場合に成立します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：tj-actions / changed-files。影響ありとして記載：1以上、46未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json" ], "evidenceIds": [ "E3" ] }, { "text": "「changed-files」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30066", "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "https://github.com/tj-actions/changed-files/issues/2463", "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "https://news.ycombinator.com/item?id=43368870", "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "https://news.ycombinator.com/item?id=43367987", "https://github.com/rackerlabs/genestack/pull/903", "https://github.com/chains-project/maven-lockfile/pull/1111", "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "https://nvd.nist.gov/vuln/detail/CVE-2025-30066" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-30066", "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "https://github.com/tj-actions/changed-files/issues/2463", "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "https://news.ycombinator.com/item?id=43368870", "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "https://news.ycombinator.com/item?id=43367987", "https://github.com/rackerlabs/genestack/pull/903", "https://github.com/chains-project/maven-lockfile/pull/1111", "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "https://nvd.nist.gov/vuln/detail/CVE-2025-30066" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-30066", "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "https://github.com/tj-actions/changed-files/issues/2463", "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "https://news.ycombinator.com/item?id=43368870", "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "https://news.ycombinator.com/item?id=43367987", "https://github.com/rackerlabs/genestack/pull/903", "https://github.com/chains-project/maven-lockfile/pull/1111", "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "https://nvd.nist.gov/vuln/detail/CVE-2025-30066" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30066", "label": "CVE公式レコード" }, { "url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/tj-actions/changed-files/issues/2463", "label": "CVE掲載の参考情報" }, { "url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "label": "CVE掲載の参考情報" }, { "url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=43368870", "label": "CVE掲載の参考情報" }, { "url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=43367987", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/rackerlabs/genestack/pull/903", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/chains-project/maven-lockfile/pull/1111", "label": "CVE掲載の参考情報" }, { "url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction", "label": "CISAが示す関連情報" }, { "url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30066", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "sourceField": "retained:/originalText", "excerpt": "tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/30xxx/CVE-2025-30066.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"changed-files\",\"vendor\":\"tj-actions\",\"versions\":[{\"lessThan\":\"46\",\"status\":\"affected\",\"version\":\"1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30066", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-30066\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-30066（changed-files）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの攻撃者が GitHub Actions のワークフローログを読み取ることができる場合に成立します。\n・公式の対象表：tj-actions / changed-files。影響ありとして記載：1以上、46未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-30066", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:52.951Z", "lastSuccess": "2026-10-24T04:55:52.951Z", "sourceCheckedAt": "2026-10-24T04:55:52.951Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-11235", "aliases": [ "GHSA-rwp7-7vc6-8477" ], "title": "PHP：コード実行", "summary": "PHP 8.3.*（8.3.19 未満）および 8.4.*（8.4.5 未満）で、__set ハンドラや ??= 演算子と例外処理を組み合わせたコードが実行されると、メモリが解放された後に参照カウントが行われ、Use‑After‑Free が発生します。攻撃者がメモリ配置を操作できる入力を提供した場合、サーバー上で攻撃者のコードを実行させられる可能性があります。", "risk": "この脆弱性が悪用されると、リモートコード実行が可能になり、攻撃者がサーバー上で任意の処理を実行できる恐れがあります。", "product": "PHP", "category": "php", "component": "core", "severity": "critical", "cvss": 9.2, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber", "affected": [ { "product": "PHP", "range": "8.4.* / < 8.4.5" }, { "product": "PHP", "range": "8.3.* / < 8.3.19" } ], "fixed": [ "8.3.19", "8.4.5" ], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11235", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-03-13T17:44:39.000Z", "modifiedAt": "2026-02-26T18:28:56.191Z", "fetchedAt": "2026-10-24T04:55:52.951Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.", "sourceTitle": "Reference counting in php_request_shutdown causes Use-After-Free", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.4.5", "status": "affected", "version": "8.4.*", "versionType": "semver" }, { "lessThan": "8.3.19", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-11235", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "fetchedAt": "2026-10-24T04:55:52.951Z", "publishedAt": "2025-04-04T17:51:07.550Z", "modifiedAt": "2026-02-26T18:28:56.191Z", "state": "published", "provider": "php", "title": "Reference counting in php_request_shutdown causes Use-After-Free", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nException handler frees variables via `cleanup_live_vars` for termination. However, the subsequent `php_request_shutdown` performs reference counting on these variables using `zend_gc_refcount`(read) and `zend_gc_delref`(write), resulting in use-after-free. Since `zend_mm_free_small` stores metadata in freed memory chunks, this use-after-free vulnerability may allows manipulation of the Zend allocator through reference count behaviors.\n\n### Details\r\n\r\n- **OS**: Ubuntu 22.04 (x86)\r\n- **PHP Version**: php-8.4.0beta5\r\n- **FYI**: A similar bug with the handler (#10169) was reported two years ago and patched, but it just increased the reference count before the handler.\r\n\r\n\r\n\r\n1. **free**: the object has a zero reference when the exception occurs, and it frees the object by `_efree`. `_efree` calls `zend_mm_free_small` internally, which writes the reference count-overlapping area to manage `zend_mm_free_slot` (Zend/zend_alloc.c:1434). \r\n2. **access**: after the exception is processed, the program requests `php_request_shutdown`, and starts to destroy the variables using destructors. In this step, PHP inspects the reference count to prevent double-free. However, the reference count is no longer valid, and it reads the part of the Zend metadata managed by `zend_mm_free_small`.\r\n3. **undefined behavior*: After the first UAF, it subsequently accesses the variables and invoke `zend_gc_delref` as well. Thus, it manipulates the metadata of `zend_mm_free_small`. Moreover, since the metadata contains typically larger value than the original reference count, the GC also lead to undefined behavior.\n\n### Impact\r\n\r\nThis is a heap use-after-free vulnerability. It occurs because reference counting is performed after live variables are destroyed by exception handlers, resulting in the manipulation of the metadata of Zend allocator. Any component that can create variables, trigger exceptions, and terminate with php_request_shutdown is affected (including PHP CLI and PHP-fuzz-execute).\r\n\r\nTo exploit this, an attacker would have to:\r\n\r\n* Find an application with code similar to this\r\n* Ensure that an exception is thrown in `__set` (it is unlikely that real code will have a statement that always throws here)\r\n* Exploit the use-after-free\r\n\r\nThis is unlikely but possible.\n\n### Version\r\n\r\nThis is present only in PHP 8.3+. The PHP 8.2 and versions before are not impacted.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.4.*", "lessThan": "8.4.5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.19", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.18; patched versions: 8.3.19", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.5; patched versions: 8.4.5", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber", "baseScore": 9.2, "baseSeverity": "CRITICAL", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-416\",\"description\":\"CWE-416 Use After Free\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"attackVector\":\"NETWORK\",\"baseScore\":9.2,\"baseSeverity\":\"CRITICAL\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"AMBER\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"HIGH\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-rwp7-7vc6-8477:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477", "sourcePath": "/description", "text": "### Summary\r\n\r\nException handler frees variables via `cleanup_live_vars` for termination. However, the subsequent `php_request_shutdown` performs reference counting on these variables using `zend_gc_refcount`(read) and `zend_gc_delref`(write), resulting in use-after-free. Since `zend_mm_free_small` stores metadata in freed memory chunks, this use-after-free vulnerability may allows manipulation of the Zend allocator through reference count behaviors.\n\n### Details\r\n\r\n- **OS**: Ubuntu 22.04 (x86)\r\n- **PHP Version**: php-8.4.0beta5\r\n- **FYI**: A similar bug with the handler (#10169) was reported two years ago and patched, but it just increased the reference count before the handler.\r\n\r\n\r\n\r\n1. **free**: the object has a zero reference when the exception occurs, and it frees the object by `_efree`. `_efree` calls `zend_mm_free_small` internally, which writes the reference count-overlapping area to manage `zend_mm_free_slot` (Zend/zend_alloc.c:1434). \r\n2. **access**: after the exception is processed, the program requests `php_request_shutdown`, and starts to destroy the variables using destructors. In this step, PHP inspects the reference count to prevent double-free. However, the reference count is no longer valid, and it reads the part of the Zend metadata managed by `zend_mm_free_small`.\r\n3. **undefined behavior*: After the first UAF, it subsequently accesses the variables and invoke `zend_gc_delref` as well. Thus, it manipulates the metadata of `zend_mm_free_small`. Moreover, since the metadata contains typically larger value than the original reference count, the GC also lead to undefined behavior.\n\n### Impact\r\n\r\nThis is a heap use-after-free vulnerability. It occurs because reference counting is performed after live variables are destroyed by exception handlers, resulting in the manipulation of the metadata of Zend allocator. Any component that can create variables, trigger exceptions, and terminate with php_request_shutdown is affected (including PHP CLI and PHP-fuzz-execute).\r\n\r\nTo exploit this, an attacker would have to:\r\n\r\n* Find an application with code similar to this\r\n* Ensure that an exception is thrown in `__set` (it is unlikely that real code will have a statement that always throws here)\r\n* Exploit the use-after-free\r\n\r\nThis is unlikely but possible.\n\n### Version\r\n\r\nThis is present only in PHP 8.3+. The PHP 8.2 and versions before are not impacted.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-rwp7-7vc6-8477:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.18\",\"patched_versions\":\"8.3.19\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-rwp7-7vc6-8477:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.5\",\"patched_versions\":\"8.4.5\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-02-26T18:28:56.191Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477", "modifiedAt": "2025-03-13T17:44:40.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T18:28:56.191Z", "fetchedAt": "2026-10-24T04:55:52.951Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-03-13T17:44:40.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:27:47.253Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "0c987dd7b3e1c8b1b694d10aba00531e8f0ede9ad74db8d79e86a4fac50a8f68", "sourceModifiedAt": "2026-02-26T18:28:56.191Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.3.*（8.3.19 未満）および 8.4.*（8.4.5 未満）で、__set ハンドラや ??= 演算子と例外処理を組み合わせたコードが実行されると、メモリが解放された後に参照カウントが行われ、Use‑After‑Free が発生します。攻撃者がメモリ配置を操作できる入力を提供した場合、サーバー上で攻撃者のコードを実行させられる可能性があります。", "risk": "この脆弱性が悪用されると、リモートコード実行が可能になり、攻撃者がサーバー上で任意の処理を実行できる恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.3.* のバージョンで 8.3.19 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.4.* のバージョンで 8.4.5 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "GitHub の脆弱性情報では、PHP 8.3 系の影響範囲が \"< 8.3.18\" と記載されています。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "GitHub の脆弱性情報では、PHP 8.4 系の影響範囲が \"< 8.4.5\" と記載されています。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "S4 と S6 の記載する 8.3 系の上限バージョンが一致していません。S4 は 8.3.19 未満、S6 は 8.3.18 未満と示しており、どちらが正しいかは現時点では判別できません。", "kind": "check", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477" ], "evidenceIds": [ "E3", "E4", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.4系のうち、8.4.5未満。影響ありとして記載：8.3系のうち、8.3.19未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-11235", "https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11235", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "sourceField": "/containers/cna/title", "excerpt": "Reference counting in php_request_shutdown causes Use-After-Free", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11235.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477", "sourceField": "/vulnerabilities/0", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.18\",\"patched_versions\":\"8.3.19\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rwp7-7vc6-8477", "sourceField": "/vulnerabilities/1", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.5\",\"patched_versions\":\"8.4.5\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2024-11235（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.3.* のバージョンで 8.3.19 未満は影響を受けます。\n・PHP 8.4.* のバージョンで 8.4.5 未満は影響を受けます。\n・GitHub の脆弱性情報では、PHP 8.3 系の影響範囲が \"< 8.3.18\" と記載されています。\n・GitHub の脆弱性情報では、PHP 8.4 系の影響範囲が \"< 8.4.5\" と記載されています。\n・S4 と S6 の記載する 8.3 系の上限バージョンが一致していません。S4 は 8.3.19 未満、S6 は 8.3.18 未満と示しており、どちらが正しいかは現時点では判別できません。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.4系のうち、8.4.5未満。影響ありとして記載：8.3系のうち、8.3.19未満。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-11235", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:52.951Z", "lastSuccess": "2026-10-24T04:55:52.951Z", "sourceCheckedAt": "2026-10-24T04:55:52.951Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "GHSA-wg4p-4hqh-c3g9", "aliases": [], "title": "PHP：脆弱性情報", "summary": "この脆弱性は bug #72714 の再発で、XML_OPTION_SKIP_TAGSTART オプションに高い値を設定すると、境界外読み取りが発生し、ヒープの内容が漏洩する可能性があります。攻撃者が期待より短いタグ名を含む XML を供給できれば、極端に高い値でなくても境界外読み取りを引き起こせます。このオプションはほとんど使用されませんが、以前の修正が不完全または正しくマージされていないようです。", "risk": "境界外読み取りによりヒープの内容が漏洩する可能性がある。", "product": "PHP", "category": "php", "component": "core", "severity": "low", "cvss": null, "cvssVersion": null, "cvssSource": "PHP Security", "cvssVector": null, "affected": [ { "product": "PHP 8.1系 / php-src", "range": "< 8.1.32（修正版 8.1.32 に対応する系列。旧系列の影響は原文確認）" }, { "product": "PHP 8.2系 / php-src", "range": "< 8.2.28（修正版 8.2.28 に対応する系列。旧系列の影響は原文確認）" }, { "product": "PHP 8.3系 / php-src", "range": "< 8.3.18（修正版 8.3.19 に対応する系列。旧系列の影響は原文確認）" }, { "product": "PHP 8.4系 / php-src", "range": "< 8.4.5（修正版 8.4.5 に対応する系列。旧系列の影響は原文確認）" } ], "fixed": [ "8.1.32", "8.2.28", "8.3.19", "8.4.5" ], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "label": "PHP Security：The PHP Group" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-wg4p-4hqh-c3g9", "label": "PHP開発元のアドバイザリ" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-03-13T17:44:29.000Z", "modifiedAt": "2025-03-13T17:44:29.000Z", "fetchedAt": "2026-10-24T04:55:52.951Z", "exploitStatus": "unknown", "sources": [ "PHP Security" ], "originalText": "This is a reocurrence of bug #72714 .", "sourceTitle": "Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "officialEvidence": { "schemaVersion": "1.0", "id": "GHSA-wg4p-4hqh-c3g9", "advisoryId": "GHSA-wg4p-4hqh-c3g9", "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "fetchedAt": "2026-10-24T04:55:52.951Z", "publishedAt": "2025-03-13T17:44:29.000Z", "modifiedAt": "2025-03-13T17:44:29.000Z", "state": "published", "provider": "The PHP Group", "title": "Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used", "descriptions": [ { "lang": "en", "value": "This is a reocurrence of bug #72714 .\n\n### Impact\r\n\r\nOut of bounds read can leak heap contents.\r\n\r\n\r\n\r\nIf we set `XML_OPTION_SKIP_TAGSTART` to a high value, we can read out of bounds.\r\nIt doesn't even have to be a crazy high value, as long as an attacker can supply XML with shorter tag names than expected they can trigger an OOB read.\r\nI coincidentally came across this by reviewing `xml.c`, I noticed this is a reocurrence of https://bugs.php.net/bug.php?id=72714\r\nThis was originally fixed in https://github.com/php/php-src/commit/9164dc11e2323b8b80c389bb13d70789799b44fc, but it seems the fix was either incomplete or not merged properly.\r\nGranted, this option is rarely used.\n\n### Workarounds\r\n\r\nDon't use `XML_OPTION_SKIP_TAGSTART`.", "sourcePath": "/description", "representation": "defensive_sections" } ], "affected": [ { "vendor": "The PHP Group", "product": "PHP", "packageName": "php-src", "sourcePath": "/vulnerabilities/0", "vulnerableVersionRange": "< 8.1.32", "patchedVersions": "8.1.32", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] }, { "vendor": "The PHP Group", "product": "PHP", "packageName": "php-src", "sourcePath": "/vulnerabilities/1", "vulnerableVersionRange": "< 8.2.28", "patchedVersions": "8.2.28", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] }, { "vendor": "The PHP Group", "product": "PHP", "packageName": "php-src", "sourcePath": "/vulnerabilities/2", "vulnerableVersionRange": "< 8.3.18", "patchedVersions": "8.3.19", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] }, { "vendor": "The PHP Group", "product": "PHP", "packageName": "php-src", "sourcePath": "/vulnerabilities/3", "vulnerableVersionRange": "< 8.4.5", "patchedVersions": "8.4.5", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.32; patched versions: 8.1.32", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.28; patched versions: 8.2.28", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.18; patched versions: 8.3.19", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.5; patched versions: 8.4.5", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-wg4p-4hqh-c3g9", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourcePath": "/description", "text": "This is a reocurrence of bug #72714 .\n\n### Impact\r\n\r\nOut of bounds read can leak heap contents.\r\n\r\n\r\n\r\nIf we set `XML_OPTION_SKIP_TAGSTART` to a high value, we can read out of bounds.\r\nIt doesn't even have to be a crazy high value, as long as an attacker can supply XML with shorter tag names than expected they can trigger an OOB read.\r\nI coincidentally came across this by reviewing `xml.c`, I noticed this is a reocurrence of https://bugs.php.net/bug.php?id=72714\r\nThis was originally fixed in https://github.com/php/php-src/commit/9164dc11e2323b8b80c389bb13d70789799b44fc, but it seems the fix was either incomplete or not merged properly.\r\nGranted, this option is rarely used.\n\n### Workarounds\r\n\r\nDon't use `XML_OPTION_SKIP_TAGSTART`.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "official:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.32\",\"patched_versions\":\"8.1.32\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.28\",\"patched_versions\":\"8.2.28\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.18\",\"patched_versions\":\"8.3.19\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.5\",\"patched_versions\":\"8.4.5\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } }, "sourceSnapshots": [ { "source": "PHP Security", "modifiedAt": "2025-03-13T17:44:29.000Z", "fetchedAt": "2026-10-24T04:55:52.951Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-03-13T17:44:29.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:27:48.077Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ab570d397882f64748b95ad5c39ff994c22295baffc3fb27600cf7fd210d3582", "sourceModifiedAt": "2025-03-13T17:44:29.000Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "この脆弱性は bug #72714 の再発で、XML_OPTION_SKIP_TAGSTART オプションに高い値を設定すると、境界外読み取りが発生し、ヒープの内容が漏洩する可能性があります。攻撃者が期待より短いタグ名を含む XML を供給できれば、極端に高い値でなくても境界外読み取りを引き起こせます。このオプションはほとんど使用されませんが、以前の修正が不完全または正しくマージされていないようです。", "risk": "境界外読み取りによりヒープの内容が漏洩する可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.1 系はバージョン 8.1.32 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.2 系はバージョン 8.2.28 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.3 系はバージョン 8.3.18 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "PHP 8.4 系はバージョン 8.4.5 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9" ], "evidenceIds": [ "E6", "E2" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9" ], "evidenceIds": [ "E2" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "XML_OPTION_SKIP_TAGSTART を使用しない。", "kind": "fix", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9" ], "evidenceIds": [ "E1" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9" ], "evidenceIds": [ "E2" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "label": "PHP Security：The PHP Group" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-wg4p-4hqh-c3g9", "label": "PHP開発元のアドバイザリ" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourceField": "/description", "excerpt": "This is a reocurrence of bug #72714 .\n\n### Impact\r\n\r\nOut of bounds read can leak heap contents.\r\n\r\n\r\n\r\nIf we set `XML_OPTION_SKIP_TAGSTART` to a high value, we can read out of bounds.\r\nIt doesn't even have to be a crazy high value, as long as an attacker can supply XML with shorter tag names than expected they can trigger an OOB read.\r\nI coincidentally came across this by reviewing `xml.c`, I noticed this is a reocurrence of https://bugs.php.net/bug.php?id=72714\r\nThis was originally fixed in https://github.com/php/php-src/commit/9164dc11e2323b8b80c389bb13d70789799b44fc, but it seems the fix was either incomplete or not merged properly.\r\nGranted, this option is rarely used.\n\n### Workarounds\r\n\r\nDon't use `XML_OPTION_SKIP_TAGSTART`.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourceField": "/title", "excerpt": "Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourceField": "/vulnerabilities/0", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.32\",\"patched_versions\":\"8.1.32\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourceField": "/vulnerabilities/1", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.28\",\"patched_versions\":\"8.2.28\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourceField": "/vulnerabilities/2", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.18\",\"patched_versions\":\"8.3.19\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wg4p-4hqh-c3g9", "sourceField": "/vulnerabilities/3", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.5\",\"patched_versions\":\"8.4.5\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：GHSA-wg4p-4hqh-c3g9（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1 系はバージョン 8.1.32 未満が影響を受ける。\n・PHP 8.2 系はバージョン 8.2.28 未満が影響を受ける。\n・PHP 8.3 系はバージョン 8.3.18 未満が影響を受ける。\n・PHP 8.4 系はバージョン 8.4.5 未満が影響を受ける。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/GHSA-wg4p-4hqh-c3g9", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:52.951Z", "lastSuccess": "2026-10-24T04:55:52.951Z", "sourceCheckedAt": "2026-10-24T04:55:52.951Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-1219", "aliases": [ "GHSA-p3x9-6h7p-cgfc" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1.*（8.1.32 未満）、8.2.*（8.2.28 未満）、8.3.*（8.3.19 未満）、8.4.*（8.4.5 未満）で、DOM または SimpleXML 拡張を使用して HTTP リソースを取得し、リダイレクトが発生した場合に、文字セット判定に用いる content‑type ヘッダーが誤って選択されます。このため、取得した文書が正しく解析されない、あるいは検証を回避できる可能性があります。", "risk": "攻撃者が文書の解析を誤らせ、内容の意味を変えたり検証を回避したりできる可能性があります。`->saveHtml()` で文書をエクスポートすると、元の文字セットがそのまま返されます。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.32" }, { "product": "PHP", "range": "8.2.* / < 8.2.28" }, { "product": "PHP", "range": "8.3.* / < 8.3.19" }, { "product": "PHP", "range": "8.4.* / < 8.4.5" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.32", "8.2.28", "8.3.19", "8.4.5" ], "steps": [ "PHP を 8.1.32、8.2.28、8.3.19、8.4.5 にアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1219", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-03-13T17:44:17.000Z", "modifiedAt": "2025-11-03T20:57:06.601Z", "fetchedAt": "2026-10-24T04:55:52.951Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.", "sourceTitle": "libxml streams use wrong content-type header when requesting a redirected resource", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.32", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.28", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.19", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.5", "status": "affected", "version": "8.4.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-1219", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json", "fetchedAt": "2026-10-24T04:55:52.951Z", "publishedAt": "2025-03-30T05:33:13.801Z", "modifiedAt": "2025-11-03T20:57:06.601Z", "state": "published", "provider": "php", "title": "libxml streams use wrong content-type header when requesting a redirected resource", "descriptions": [ { "lang": "en", "value": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nWhen requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong `content-type` header is used to determine the charset when the requested resource performs a redirect.\n\n### Details\r\n\r\nWhen the HTTP stream wrapper follows a redirect, it does not clear the list of captured headers before performing the following requests. This means in the returned array containing the response headers, the headers of multiple requests are stored one after each other. The final request comes last in this array.\r\n\r\nThe `php_libxml_input_buffer_create_filename()` / `php_libxml_sniff_charset_from_stream()` function scans the header array from top to bottom, returning after finding the first `content-type` header. This `content-type` header does not necessarily belong to the response that corresponds to the HTML body that is being parsed.\n\n### Impact\r\n\r\nThis allows an attacker to cause a document to be parsed incorrectly, changing its meaning and possibly bypassing validation. When exporting such a document with `->saveHtml()` the document will be returned with the original charset.\r\n\r\nUsers that request documents via HTTP using the DOM or SimpleXML extensions are impacted.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.32", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.28", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.19", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.32; patched versions: 8.1.32", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.28; patched versions: 8.2.28", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.18; patched versions: 8.3.19", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.5; patched versions: 8.4.5", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20250523-0007/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.32\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.28\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"attackVector\":\"NETWORK\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-p3x9-6h7p-cgfc:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc", "sourcePath": "/description", "text": "### Summary\r\n\r\nWhen requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong `content-type` header is used to determine the charset when the requested resource performs a redirect.\n\n### Details\r\n\r\nWhen the HTTP stream wrapper follows a redirect, it does not clear the list of captured headers before performing the following requests. This means in the returned array containing the response headers, the headers of multiple requests are stored one after each other. The final request comes last in this array.\r\n\r\nThe `php_libxml_input_buffer_create_filename()` / `php_libxml_sniff_charset_from_stream()` function scans the header array from top to bottom, returning after finding the first `content-type` header. This `content-type` header does not necessarily belong to the response that corresponds to the HTML body that is being parsed.\n\n### Impact\r\n\r\nThis allows an attacker to cause a document to be parsed incorrectly, changing its meaning and possibly bypassing validation. When exporting such a document with `->saveHtml()` the document will be returned with the original charset.\r\n\r\nUsers that request documents via HTTP using the DOM or SimpleXML extensions are impacted.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-p3x9-6h7p-cgfc:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.32\",\"patched_versions\":\"8.1.32\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-p3x9-6h7p-cgfc:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.28\",\"patched_versions\":\"8.2.28\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-p3x9-6h7p-cgfc:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.18\",\"patched_versions\":\"8.3.19\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-p3x9-6h7p-cgfc:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.5\",\"patched_versions\":\"8.4.5\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T20:57:06.601Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc", "modifiedAt": "2025-03-13T17:44:17.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T20:57:06.601Z", "fetchedAt": "2026-10-24T04:55:52.951Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-03-13T17:44:17.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:27:48.270Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e47e542c6999d90cc663db3e8941e9a805e6ad02ec7537ef0b17960a56c6d9c8", "sourceModifiedAt": "2025-11-03T20:57:06.601Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.32 未満）、8.2.*（8.2.28 未満）、8.3.*（8.3.19 未満）、8.4.*（8.4.5 未満）で、DOM または SimpleXML 拡張を使用して HTTP リソースを取得し、リダイレクトが発生した場合に、文字セット判定に用いる content‑type ヘッダーが誤って選択されます。このため、取得した文書が正しく解析されない、あるいは検証を回避できる可能性があります。", "risk": "攻撃者が文書の解析を誤らせ、内容の意味を変えたり検証を回避したりできる可能性があります。`->saveHtml()` で文書をエクスポートすると、元の文字セットがそのまま返されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "PHP 8.1.*（8.1.32 未満）、8.2.*（8.2.28 未満）、8.3.*（8.3.19 未満）、8.4.*（8.4.5 未満）のすべてのバージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "DOM または SimpleXML 拡張を使って HTTP 経由で文書を取得するユーザーが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.32未満。影響ありとして記載：8.2系のうち、8.2.28未満。影響ありとして記載：8.3系のうち、8.3.19未満。影響ありとして記載：8.4系のうち、8.4.5未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.32、8.2.28、8.3.19、8.4.5 にアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc" ], "evidenceIds": [ "E5" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-1219", "https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1219", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json", "sourceField": "/containers/cna/title", "excerpt": "libxml streams use wrong content-type header when requesting a redirected resource", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p3x9-6h7p-cgfc", "sourceField": "/description", "excerpt": "### Summary\r\n\r\nWhen requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong `content-type` header is used to determine the charset when the requested resource performs a redirect.\n\n### Details\r\n\r\nWhen the HTTP stream wrapper follows a redirect, it does not clear the list of captured headers before performing the following requests. This means in the returned array containing the response headers, the headers of multiple requests are stored one after each other. The final request comes last in this array.\r\n\r\nThe `php_libxml_input_buffer_create_filename()` / `php_libxml_sniff_charset_from_stream()` function scans the header array from top to bottom, returning after finding the first `content-type` header. This `content-type` header does not necessarily belong to the response that corresponds to the HTML body that is being parsed.\n\n### Impact\r\n\r\nThis allows an attacker to cause a document to be parsed incorrectly, changing its meaning and possibly bypassing validation. When exporting such a document with `->saveHtml()` the document will be returned with the original charset.\r\n\r\nUsers that request documents via HTTP using the DOM or SimpleXML extensions are impacted.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1219.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.32\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.28\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc", "sourceField": "/fixed", "excerpt": "[\"8.1.32\",\"8.2.28\",\"8.3.19\",\"8.4.5\"]", "language": null } ], "supportRequest": "件名：CVE-2025-1219（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.*（8.1.32 未満）、8.2.*（8.2.28 未満）、8.3.*（8.3.19 未満）、8.4.*（8.4.5 未満）のすべてのバージョンが影響を受けます。\n・DOM または SimpleXML 拡張を使って HTTP 経由で文書を取得するユーザーが影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.32未満。影響ありとして記載：8.2系のうち、8.2.28未満。影響ありとして記載：8.3系のうち、8.3.19未満。影響ありとして記載：8.4系のうち、8.4.5未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-1219", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:52.951Z", "lastSuccess": "2026-10-24T04:55:52.951Z", "sourceCheckedAt": "2026-10-24T04:55:52.951Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-1736", "aliases": [ "GHSA-hgf5-96fm-v528" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1.*（8.1.32 未満）、8.2.*（8.2.28 未満）、8.3.*（8.3.19 未満）、8.4.*（8.4.5 未満）において、ユーザーが提供したヘッダーを送信する際に、行末文字の検証が不十分なため、特定のヘッダーが送信されなかったり、誤って解釈されたりする可能性があります。", "risk": "認証ヘッダーが送信されず、サービスが利用できなくなる（DoS）可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.32" }, { "product": "PHP", "range": "8.2.* / < 8.2.28" }, { "product": "PHP", "range": "8.3.* / < 8.3.19" }, { "product": "PHP", "range": "8.4.* / < 8.4.5" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.32", "8.2.28", "8.3.19", "8.4.5" ], "steps": [ "PHP を 8.1.32、8.2.28、8.3.19、8.4.5 にアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1736", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-03-13T17:44:08.000Z", "modifiedAt": "2025-11-03T20:57:10.963Z", "fetchedAt": "2026-10-24T04:55:54.387Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.", "sourceTitle": "Stream HTTP wrapper header check might omit basic auth header", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.32", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.28", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.19", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.5", "status": "affected", "version": "8.4.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-1736", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "fetchedAt": "2026-10-24T04:55:54.387Z", "publishedAt": "2025-03-30T05:49:14.551Z", "modifiedAt": "2025-11-03T20:57:10.963Z", "state": "published", "provider": "php", "title": "Stream HTTP wrapper header check might omit basic auth header", "descriptions": [ { "lang": "en", "value": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Details\r\n\r\nCurrently the header check in `check_has_header` does not verify `\\r` which could potentially lead to some misbehaviour if only `\\n` is used in the header value. If this value is provided by user and not checked properly (e.g. it can be cookie value and it is not unlikely it could be taken from the user input (at least partially)), then it could specify it like for example `Cookie: x=y\\nauhtorization:x\\r\\n`. If the URL has user part in it, then this can disable sending of that authorization header. That could potentially impact the result and lead potentially to DoS or potentially to some unexpected issues.\n\n### Impact\r\n\r\nPreventing authorization header to be sent.\r\n\r\nThere are also some implication for other headers like user-agent and other checked by this functions. The impact is less likely but there could be possibly some security implications as well.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.32", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.28", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.19", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.32; patched versions: 8.1.32", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.28; patched versions: 8.2.28", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.18; patched versions: 8.3.19", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.5; patched versions: 8.4.5", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20250523-0006/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.32\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.28\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-20\",\"description\":\"CWE-20 Improper Input Validation\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"attackVector\":\"NETWORK\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hgf5-96fm-v528:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "sourcePath": "/description", "text": "### Details\r\n\r\nCurrently the header check in `check_has_header` does not verify `\\r` which could potentially lead to some misbehaviour if only `\\n` is used in the header value. If this value is provided by user and not checked properly (e.g. it can be cookie value and it is not unlikely it could be taken from the user input (at least partially)), then it could specify it like for example `Cookie: x=y\\nauhtorization:x\\r\\n`. If the URL has user part in it, then this can disable sending of that authorization header. That could potentially impact the result and lead potentially to DoS or potentially to some unexpected issues.\n\n### Impact\r\n\r\nPreventing authorization header to be sent.\r\n\r\nThere are also some implication for other headers like user-agent and other checked by this functions. The impact is less likely but there could be possibly some security implications as well.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-hgf5-96fm-v528:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.32\",\"patched_versions\":\"8.1.32\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hgf5-96fm-v528:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.28\",\"patched_versions\":\"8.2.28\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hgf5-96fm-v528:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.18\",\"patched_versions\":\"8.3.19\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hgf5-96fm-v528:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.5\",\"patched_versions\":\"8.4.5\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T20:57:10.963Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "modifiedAt": "2025-03-13T17:44:08.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T20:57:10.963Z", "fetchedAt": "2026-10-24T04:55:54.387Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-03-13T17:44:08.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:27:48.311Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c2bf08333be7b7415ed38c80858c338bffe96e0642cba9973bcf74c11f8b2e15", "sourceModifiedAt": "2025-11-03T20:57:10.963Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.32 未満）、8.2.*（8.2.28 未満）、8.3.*（8.3.19 未満）、8.4.*（8.4.5 未満）において、ユーザーが提供したヘッダーを送信する際に、行末文字の検証が不十分なため、特定のヘッダーが送信されなかったり、誤って解釈されたりする可能性があります。", "risk": "認証ヘッダーが送信されず、サービスが利用できなくなる（DoS）可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "PHP 8.1.*（8.1.32 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528" ], "evidenceIds": [ "E4", "E5", "E1" ] }, { "text": "PHP 8.2.*（8.2.28 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528" ], "evidenceIds": [ "E4", "E6", "E1" ] }, { "text": "PHP 8.3.*（8.3.19 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528" ], "evidenceIds": [ "E4", "E7", "E1" ] }, { "text": "PHP 8.4.*（8.4.5 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528" ], "evidenceIds": [ "E4", "E8", "E1" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.32未満。影響ありとして記載：8.2系のうち、8.2.28未満。影響ありとして記載：8.3系のうち、8.3.19未満。影響ありとして記載：8.4系のうち、8.4.5未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.32、8.2.28、8.3.19、8.4.5 にアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528" ], "evidenceIds": [ "E9" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-1736", "https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1736", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "sourceField": "/containers/cna/title", "excerpt": "Stream HTTP wrapper header check might omit basic auth header", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "sourceField": "/description", "excerpt": "### Details\r\n\r\nCurrently the header check in `check_has_header` does not verify `\\r` which could potentially lead to some misbehaviour if only `\\n` is used in the header value. If this value is provided by user and not checked properly (e.g. it can be cookie value and it is not unlikely it could be taken from the user input (at least partially)), then it could specify it like for example `Cookie: x=y\\nauhtorization:x\\r\\n`. If the URL has user part in it, then this can disable sending of that authorization header. That could potentially impact the result and lead potentially to DoS or potentially to some unexpected issues.\n\n### Impact\r\n\r\nPreventing authorization header to be sent.\r\n\r\nThere are also some implication for other headers like user-agent and other checked by this functions. The impact is less likely but there could be possibly some security implications as well.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1736.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.32\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.28\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "sourceField": "/vulnerabilities/0", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.32\",\"patched_versions\":\"8.1.32\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "sourceField": "/vulnerabilities/1", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.28\",\"patched_versions\":\"8.2.28\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "sourceField": "/vulnerabilities/2", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.18\",\"patched_versions\":\"8.3.19\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hgf5-96fm-v528", "sourceField": "/vulnerabilities/3", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.5\",\"patched_versions\":\"8.4.5\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528", "sourceField": "/fixed", "excerpt": "[\"8.1.32\",\"8.2.28\",\"8.3.19\",\"8.4.5\"]", "language": null } ], "supportRequest": "件名：CVE-2025-1736（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.*（8.1.32 未満）が影響を受けます。\n・PHP 8.2.*（8.2.28 未満）が影響を受けます。\n・PHP 8.3.*（8.3.19 未満）が影響を受けます。\n・PHP 8.4.*（8.4.5 未満）が影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.32未満。影響ありとして記載：8.2系のうち、8.2.28未満。影響ありとして記載：8.3系のうち、8.3.19未満。影響ありとして記載：8.4系のうち、8.4.5未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-1736", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:54.387Z", "lastSuccess": "2026-10-24T04:55:54.387Z", "sourceCheckedAt": "2026-10-24T04:55:54.387Z", "errorCode": null }, "glossary": [ { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-1861", "aliases": [ "GHSA-52jp-hrpf-2jff" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1.* で 8.1.32 未満、8.2.* で 8.2.28 未満、8.3.* で 8.3.19 未満、8.4.* で 8.4.5 未満のバージョンでは、HTTP リクエストのレスポンスに含まれるリダイレクトを解析する際、location ヘッダーの値を格納するバッファが 1024 バイトに制限されています。RFC9110 では 8000 バイトが推奨されているため、URL が不正に切り詰められ、誤った場所へリダイレクトされる可能性があります。", "risk": "URL が切り詰められると、クエリ文字列などの重要な情報が欠落したり、別のリソースへリダイレクトされたりする可能性があります。切り詰められた URL がエラーを引き起こすと、リモートサイトが利用できなくなる（DoS）こともあり得ます。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.32" }, { "product": "PHP", "range": "8.2.* / < 8.2.28" }, { "product": "PHP", "range": "8.3.* / < 8.3.19" }, { "product": "PHP", "range": "8.4.* / < 8.4.5" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.32", "8.2.28", "8.3.19", "8.4.5" ], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1861", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-03-13T17:44:03.000Z", "modifiedAt": "2025-11-03T20:57:13.769Z", "fetchedAt": "2026-10-24T04:55:54.506Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.", "sourceTitle": "Stream HTTP wrapper truncates redirect location to 1024 bytes", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.32", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.28", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.19", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.5", "status": "affected", "version": "8.4.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-1861", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json", "fetchedAt": "2026-10-24T04:55:54.506Z", "publishedAt": "2025-03-30T05:57:57.894Z", "modifiedAt": "2025-11-03T20:57:13.769Z", "state": "published", "provider": "php", "title": "Stream HTTP wrapper truncates redirect location to 1024 bytes", "descriptions": [ { "lang": "en", "value": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "There is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per https://www.rfc-editor.org/rfc/rfc9110#name-uri-references , the limit is recommended to 8000. The browser limit is usually around 2048 so 1024 is really too low and it might have a real impact in practice.\n\n### Impact\r\n\r\nThe URI truncation might result in omitting some critical information (e.g. from the query) or even redirection to other resources. It could even result in DOS of the remote site if the trucated URL results in error.\n\n### Workarounds\r\n\r\nThere is no real workaround for this", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.32", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.28", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.19", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.32; patched versions: 8.1.32", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.28; patched versions: 8.2.28", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.18; patched versions: 8.3.19", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.5; patched versions: 8.4.5", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-131", "lang": "en", "description": "CWE-131 Incorrect Calculation of Buffer Size", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20250523-0005/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.32\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.28\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-131\",\"description\":\"CWE-131 Incorrect Calculation of Buffer Size\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"attackVector\":\"NETWORK\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-52jp-hrpf-2jff:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff", "sourcePath": "/description", "text": "There is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per https://www.rfc-editor.org/rfc/rfc9110#name-uri-references , the limit is recommended to 8000. The browser limit is usually around 2048 so 1024 is really too low and it might have a real impact in practice.\n\n### Impact\r\n\r\nThe URI truncation might result in omitting some critical information (e.g. from the query) or even redirection to other resources. It could even result in DOS of the remote site if the trucated URL results in error.\n\n### Workarounds\r\n\r\nThere is no real workaround for this", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-52jp-hrpf-2jff:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.32\",\"patched_versions\":\"8.1.32\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-52jp-hrpf-2jff:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.28\",\"patched_versions\":\"8.2.28\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-52jp-hrpf-2jff:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.18\",\"patched_versions\":\"8.3.19\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-52jp-hrpf-2jff:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.5\",\"patched_versions\":\"8.4.5\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T20:57:13.769Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff", "modifiedAt": "2025-03-13T17:44:03.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T20:57:13.769Z", "fetchedAt": "2026-10-24T04:55:54.506Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-03-13T17:44:03.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:27:49.715Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "360807ba658c611a214a449a9e3e27e0b1c8510ee212f64486c660420e79aee6", "sourceModifiedAt": "2025-11-03T20:57:13.769Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.* で 8.1.32 未満、8.2.* で 8.2.28 未満、8.3.* で 8.3.19 未満、8.4.* で 8.4.5 未満のバージョンでは、HTTP リクエストのレスポンスに含まれるリダイレクトを解析する際、location ヘッダーの値を格納するバッファが 1024 バイトに制限されています。RFC9110 では 8000 バイトが推奨されているため、URL が不正に切り詰められ、誤った場所へリダイレクトされる可能性があります。", "risk": "URL が切り詰められると、クエリ文字列などの重要な情報が欠落したり、別のリソースへリダイレクトされたりする可能性があります。切り詰められた URL がエラーを引き起こすと、リモートサイトが利用できなくなる（DoS）こともあり得ます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "PHP 8.1.* のバージョンが 8.1.32 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.2.* のバージョンが 8.2.28 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.3.* のバージョンが 8.3.19 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.4.* のバージョンが 8.4.5 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.32未満。影響ありとして記載：8.2系のうち、8.2.28未満。影響ありとして記載：8.3系のうち、8.3.19未満。影響ありとして記載：8.4系のうち、8.4.5未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-1861", "https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1861", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json", "sourceField": "/containers/cna/title", "excerpt": "Stream HTTP wrapper truncates redirect location to 1024 bytes", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-52jp-hrpf-2jff", "sourceField": "/description", "excerpt": "There is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per https://www.rfc-editor.org/rfc/rfc9110#name-uri-references , the limit is recommended to 8000. The browser limit is usually around 2048 so 1024 is really too low and it might have a real impact in practice.\n\n### Impact\r\n\r\nThe URI truncation might result in omitting some critical information (e.g. from the query) or even redirection to other resources. It could even result in DOS of the remote site if the trucated URL results in error.\n\n### Workarounds\r\n\r\nThere is no real workaround for this", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1861.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.32\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.28\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2025-1861（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.* のバージョンが 8.1.32 未満は影響を受けます。\n・PHP 8.2.* のバージョンが 8.2.28 未満は影響を受けます。\n・PHP 8.3.* のバージョンが 8.3.19 未満は影響を受けます。\n・PHP 8.4.* のバージョンが 8.4.5 未満は影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.32未満。影響ありとして記載：8.2系のうち、8.2.28未満。影響ありとして記載：8.3系のうち、8.3.19未満。影響ありとして記載：8.4系のうち、8.4.5未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-1861", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:54.506Z", "lastSuccess": "2026-10-24T04:55:54.506Z", "sourceCheckedAt": "2026-10-24T04:55:54.506Z", "errorCode": null }, "glossary": [ { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-1734", "aliases": [ "GHSA-pcmh-g36c-qc44" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1.*（8.1.32 未満）、8.2.*（8.2.28 未満）、8.3.*（8.3.19 未満）、8.4.*（8.4.5 未満）では、HTTP サーバーから受信したヘッダーにコロン (:) が無い場合でも有効なヘッダーとして扱われ、アプリケーションが無効なヘッダーを受け入れる可能性があります。", "risk": "アプリケーションがヘッダーを正しく解析できず、リクエストスミグリングが起こる可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.32" }, { "product": "PHP", "range": "8.2.* / < 8.2.28" }, { "product": "PHP", "range": "8.3.* / < 8.3.19" }, { "product": "PHP", "range": "8.4.* / < 8.4.5" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.32", "8.2.28", "8.3.19", "8.4.5" ], "steps": [ "PHP を 8.1.32、8.2.28、8.3.19、8.4.5 以降のバージョンにアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1734", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-03-13T17:43:58.000Z", "modifiedAt": "2025-11-03T20:57:09.506Z", "fetchedAt": "2026-10-24T04:55:54.594Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.", "sourceTitle": "Streams HTTP wrapper does not fail for headers with invalid name and no colon", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.32", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.28", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.19", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.5", "status": "affected", "version": "8.4.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-1734", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json", "fetchedAt": "2026-10-24T04:55:54.594Z", "publishedAt": "2025-03-30T05:43:35.771Z", "modifiedAt": "2025-11-03T20:57:09.506Z", "state": "published", "provider": "php", "title": "Streams HTTP wrapper does not fail for headers with invalid name and no colon", "descriptions": [ { "lang": "en", "value": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "The headers without colon are currently returned without in `$http_response_header`. It means that something like:\r\n\r\n\r\n\r\nresults in following `$http_response_header`\r\n\r\n\r\n\r\nIn addition headers that contain a space in header name (before the colon) will also not fail which is not allowed by RFC.\n\n### Impact\r\n\r\nThis can allow issues in the application when parsing the array - e.g. application could consider it as a valid header or as a continuation of the previous one (currently folding header are misbehaving so there could be some logic for that in the application that could result in a security issue). So some sort of request smuggling could be possible in this case\n\n### Workarounds\r\n\r\nUsers can add a special handling of `$http_response_header`. No notification is triggered for this sort of header so no extra handling there is needed.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.32", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.28", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.19", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.32; patched versions: 8.1.32", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.28; patched versions: 8.2.28", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.18; patched versions: 8.3.19", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.5; patched versions: 8.4.5", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20250523-0009/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.32\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.28\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-20\",\"description\":\"CWE-20 Improper Input Validation\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"attackVector\":\"NETWORK\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-pcmh-g36c-qc44:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44", "sourcePath": "/description", "text": "The headers without colon are currently returned without in `$http_response_header`. It means that something like:\r\n\r\n\r\n\r\nresults in following `$http_response_header`\r\n\r\n\r\n\r\nIn addition headers that contain a space in header name (before the colon) will also not fail which is not allowed by RFC.\n\n### Impact\r\n\r\nThis can allow issues in the application when parsing the array - e.g. application could consider it as a valid header or as a continuation of the previous one (currently folding header are misbehaving so there could be some logic for that in the application that could result in a security issue). So some sort of request smuggling could be possible in this case\n\n### Workarounds\r\n\r\nUsers can add a special handling of `$http_response_header`. No notification is triggered for this sort of header so no extra handling there is needed.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-pcmh-g36c-qc44:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.32\",\"patched_versions\":\"8.1.32\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-pcmh-g36c-qc44:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.28\",\"patched_versions\":\"8.2.28\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-pcmh-g36c-qc44:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.18\",\"patched_versions\":\"8.3.19\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-pcmh-g36c-qc44:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.5\",\"patched_versions\":\"8.4.5\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T20:57:09.506Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44", "modifiedAt": "2025-03-13T17:43:58.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T20:57:09.506Z", "fetchedAt": "2026-10-24T04:55:54.594Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-03-13T17:43:58.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:27:51.286Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3544c9bc9214766dd16b4e2085aac8511189a055c7fc25fe6e9d4e3a6d5f7efa", "sourceModifiedAt": "2025-11-03T20:57:09.506Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.32 未満）、8.2.*（8.2.28 未満）、8.3.*（8.3.19 未満）、8.4.*（8.4.5 未満）では、HTTP サーバーから受信したヘッダーにコロン (:) が無い場合でも有効なヘッダーとして扱われ、アプリケーションが無効なヘッダーを受け入れる可能性があります。", "risk": "アプリケーションがヘッダーを正しく解析できず、リクエストスミグリングが起こる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "PHP 8.1.*（8.1.32 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.2.*（8.2.28 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.3.*（8.3.19 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.4.*（8.4.5 未満）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.32未満。影響ありとして記載：8.2系のうち、8.2.28未満。影響ありとして記載：8.3系のうち、8.3.19未満。影響ありとして記載：8.4系のうち、8.4.5未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.32、8.2.28、8.3.19、8.4.5 以降のバージョンにアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44" ], "evidenceIds": [ "E5" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-1734", "https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1734", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json", "sourceField": "/containers/cna/title", "excerpt": "Streams HTTP wrapper does not fail for headers with invalid name and no colon", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-pcmh-g36c-qc44", "sourceField": "/description", "excerpt": "The headers without colon are currently returned without in `$http_response_header`. It means that something like:\r\n\r\n\r\n\r\nresults in following `$http_response_header`\r\n\r\n\r\n\r\nIn addition headers that contain a space in header name (before the colon) will also not fail which is not allowed by RFC.\n\n### Impact\r\n\r\nThis can allow issues in the application when parsing the array - e.g. application could consider it as a valid header or as a continuation of the previous one (currently folding header are misbehaving so there could be some logic for that in the application that could result in a security issue). So some sort of request smuggling could be possible in this case\n\n### Workarounds\r\n\r\nUsers can add a special handling of `$http_response_header`. No notification is triggered for this sort of header so no extra handling there is needed.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1734.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.32\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.28\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44", "sourceField": "/fixed", "excerpt": "[\"8.1.32\",\"8.2.28\",\"8.3.19\",\"8.4.5\"]", "language": null } ], "supportRequest": "件名：CVE-2025-1734（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.*（8.1.32 未満）が影響を受けます。\n・PHP 8.2.*（8.2.28 未満）が影響を受けます。\n・PHP 8.3.*（8.3.19 未満）が影響を受けます。\n・PHP 8.4.*（8.4.5 未満）が影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.32未満。影響ありとして記載：8.2系のうち、8.2.28未満。影響ありとして記載：8.3系のうち、8.3.19未満。影響ありとして記載：8.4系のうち、8.4.5未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-1734", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:54.594Z", "lastSuccess": "2026-10-24T04:55:54.594Z", "sourceCheckedAt": "2026-10-24T04:55:54.594Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-1217", "aliases": [ "GHSA-v8xr-gpvj-cx9g" ], "title": "PHP：脆弱性情報", "summary": "PHP の http ストリームラッパーのヘッダーパーサーが折りたたみヘッダー（行頭が空白で始まるヘッダー）を正しく処理せず、サーバーから取得した HTTP 応答を誤って解析し、誤ったヘッダーや MIME タイプなどを使用する可能性があります。", "risk": "http ストリームラッパーを利用するユーザーは、誤った MIME タイプが通知されたり、レスポンスヘッダーを誤って解釈したりする可能性があります。たとえば、リダイレクトが発生した場合に最終レスポンスのヘッダーを正しく判別できなくなることがあります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:A", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.32" }, { "product": "PHP", "range": "8.2.* / < 8.2.28" }, { "product": "PHP", "range": "8.3.* / < 8.3.19" }, { "product": "PHP", "range": "8.4.* / < 8.4.5" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.32", "8.2.28", "8.3.19", "8.4.5" ], "steps": [ "PHP を 8.1.32、8.2.28、8.3.19、8.4.5 以上のバージョンにアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1217", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-03-13T17:43:52.000Z", "modifiedAt": "2025-11-03T20:57:05.208Z", "fetchedAt": "2026-10-24T04:55:55.810Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.", "sourceTitle": "Header parser of http stream wrapper does not handle folded headers", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.32", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.28", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.19", "status": "affected", "version": "8.3.*", "versionType": "semver" }, { "lessThan": "8.4.5", "status": "affected", "version": "8.4.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-1217", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json", "fetchedAt": "2026-10-24T04:55:55.810Z", "publishedAt": "2025-03-29T05:19:33.696Z", "modifiedAt": "2025-11-03T20:57:05.208Z", "state": "published", "provider": "php", "title": "Header parser of http stream wrapper does not handle folded headers", "descriptions": [ { "lang": "en", "value": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nThe header parser of the `http` stream wrapper does not handle folded headers and passes incorrect MIME types to an attached stream notifier.\n\n### Details\r\n\r\nThe header parser of the `http` stream parser does not understand that a header line beginning with whitespace continues the previous header and instead considers every newline to be a header separator.\r\n\r\nThis has two consequences:\r\n\r\n1. The `STREAM_NOTIFY_MIME_TYPE_IS` notification might report an incorrect MIME type, if the `content-type` header is a folded header.\r\n2. The `$http_response_header` array contains the header continuation lines as they appear on-the-wire, requiring userland code to be aware of folded headers and violating [RFC9112#5.2](https://datatracker.ietf.org/doc/html/rfc9112#section-5.2), which specifies:\r\n > A user agent that receives an [obs-fold](https://datatracker.ietf.org/doc/html/rfc9112#line.folding) in a response message that is not within a \"message/http\" container MUST replace each received [obs-fold](https://datatracker.ietf.org/doc/html/rfc9112#line.folding) with one or more [SP](https://datatracker.ietf.org/doc/html/rfc9112#core.rules) octets prior to interpreting the field value.\n\n### Impact\r\n\r\nUsers of the `http` stream wrapper might interpret the response with an incorrect MIME type and more generally might misparse the response, for example by incorrectly determining which response headers belong to the final response if a redirect happened.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.32", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.28", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.19", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.4.*", "lessThan": "8.4.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.32; patched versions: 8.1.32", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.28; patched versions: 8.2.28", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.18; patched versions: 8.3.19", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.5; patched versions: 8.4.5", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:A", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20250523-0008/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.32\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.28\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-20\",\"description\":\"CWE-20 Improper Input Validation\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"YES\",\"Recovery\":\"AUTOMATIC\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"attackVector\":\"NETWORK\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:A\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-v8xr-gpvj-cx9g:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g", "sourcePath": "/description", "text": "### Summary\r\n\r\nThe header parser of the `http` stream wrapper does not handle folded headers and passes incorrect MIME types to an attached stream notifier.\n\n### Details\r\n\r\nThe header parser of the `http` stream parser does not understand that a header line beginning with whitespace continues the previous header and instead considers every newline to be a header separator.\r\n\r\nThis has two consequences:\r\n\r\n1. The `STREAM_NOTIFY_MIME_TYPE_IS` notification might report an incorrect MIME type, if the `content-type` header is a folded header.\r\n2. The `$http_response_header` array contains the header continuation lines as they appear on-the-wire, requiring userland code to be aware of folded headers and violating [RFC9112#5.2](https://datatracker.ietf.org/doc/html/rfc9112#section-5.2), which specifies:\r\n > A user agent that receives an [obs-fold](https://datatracker.ietf.org/doc/html/rfc9112#line.folding) in a response message that is not within a \"message/http\" container MUST replace each received [obs-fold](https://datatracker.ietf.org/doc/html/rfc9112#line.folding) with one or more [SP](https://datatracker.ietf.org/doc/html/rfc9112#core.rules) octets prior to interpreting the field value.\n\n### Impact\r\n\r\nUsers of the `http` stream wrapper might interpret the response with an incorrect MIME type and more generally might misparse the response, for example by incorrectly determining which response headers belong to the final response if a redirect happened.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-v8xr-gpvj-cx9g:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.32\",\"patched_versions\":\"8.1.32\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-v8xr-gpvj-cx9g:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.28\",\"patched_versions\":\"8.2.28\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-v8xr-gpvj-cx9g:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.18\",\"patched_versions\":\"8.3.19\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-v8xr-gpvj-cx9g:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.4.5\",\"patched_versions\":\"8.4.5\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T20:57:05.208Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g", "modifiedAt": "2025-03-13T17:43:53.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T20:57:05.208Z", "fetchedAt": "2026-10-24T04:55:55.810Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2025-03-13T17:43:53.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:27:51.859Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "fefa8ebe3d738c0eabb2cfc9ff9e08cf0561c245f36e6ecda271ba5a2d456e8a", "sourceModifiedAt": "2025-11-03T20:57:05.208Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP の http ストリームラッパーのヘッダーパーサーが折りたたみヘッダー（行頭が空白で始まるヘッダー）を正しく処理せず、サーバーから取得した HTTP 応答を誤って解析し、誤ったヘッダーや MIME タイプなどを使用する可能性があります。", "risk": "http ストリームラッパーを利用するユーザーは、誤った MIME タイプが通知されたり、レスポンスヘッダーを誤って解釈したりする可能性があります。たとえば、リダイレクトが発生した場合に最終レスポンスのヘッダーを正しく判別できなくなることがあります。", "summaryEvidenceIds": [ "E1", "E2", "E3" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.32未満。影響ありとして記載：8.2系のうち、8.2.28未満。影響ありとして記載：8.3系のうち、8.3.19未満。影響ありとして記載：8.4系のうち、8.4.5未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.32、8.2.28、8.3.19、8.4.5 以上のバージョンにアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g" ], "evidenceIds": [ "E5" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-1217", "https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1217", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-v8xr-gpvj-cx9g", "sourceField": "/description", "excerpt": "### Summary\r\n\r\nThe header parser of the `http` stream wrapper does not handle folded headers and passes incorrect MIME types to an attached stream notifier.\n\n### Details\r\n\r\nThe header parser of the `http` stream parser does not understand that a header line beginning with whitespace continues the previous header and instead considers every newline to be a header separator.\r\n\r\nThis has two consequences:\r\n\r\n1. The `STREAM_NOTIFY_MIME_TYPE_IS` notification might report an incorrect MIME type, if the `content-type` header is a folded header.\r\n2. The `$http_response_header` array contains the header continuation lines as they appear on-the-wire, requiring userland code to be aware of folded headers and violating [RFC9112#5.2](https://datatracker.ietf.org/doc/html/rfc9112#section-5.2), which specifies:\r\n > A user agent that receives an [obs-fold](https://datatracker.ietf.org/doc/html/rfc9112#line.folding) in a response message that is not within a \"message/http\" container MUST replace each received [obs-fold](https://datatracker.ietf.org/doc/html/rfc9112#line.folding) with one or more [SP](https://datatracker.ietf.org/doc/html/rfc9112#core.rules) octets prior to interpreting the field value.\n\n### Impact\r\n\r\nUsers of the `http` stream wrapper might interpret the response with an incorrect MIME type and more generally might misparse the response, for example by incorrectly determining which response headers belong to the final response if a redirect happened.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json", "sourceField": "/containers/cna/title", "excerpt": "Header parser of http stream wrapper does not handle folded headers", "language": null }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1217.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.32\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.28\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.19\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.4.5\",\"status\":\"affected\",\"version\":\"8.4.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g", "sourceField": "/fixed", "excerpt": "[\"8.1.32\",\"8.2.28\",\"8.3.19\",\"8.4.5\"]", "language": null } ], "supportRequest": "件名：CVE-2025-1217（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.32未満。影響ありとして記載：8.2系のうち、8.2.28未満。影響ありとして記載：8.3系のうち、8.3.19未満。影響ありとして記載：8.4系のうち、8.4.5未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-1217", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:55.810Z", "lastSuccess": "2026-10-24T04:55:55.810Z", "sourceCheckedAt": "2026-10-24T04:55:55.810Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-21590", "aliases": [], "title": "Junos OS：コード実行", "summary": "Juniper Networks の Junos OS カーネルに不適切な分離・区画化の脆弱性があり、シェルにアクセスできるローカル攻撃者が任意のコードを注入してデバイスの完全性を侵害できる。この脆弱性は Junos CLI からは悪用できない。", "risk": "デバイスの完全性が侵害され、攻撃者が任意のコードを実行できる可能性がある。", "product": "Junos OS", "category": "other", "component": "package", "severity": "medium", "cvss": 4.4, "cvssVersion": "3.1", "cvssSource": "juniper", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "affected": [ { "product": "Junos OS", "range": "< 21.2R3-S9" }, { "product": "Junos OS", "range": ">= 21.4 / < 21.4R3-S10" }, { "product": "Junos OS", "range": ">= 22.2 / < 22.2R3-S6" }, { "product": "Junos OS", "range": ">= 22.4 / < 22.4R3-S6" }, { "product": "Junos OS", "range": ">= 23.2 / < 23.2R2-S3" }, { "product": "Junos OS", "range": ">= 23.4 / < 23.4R2-S4" }, { "product": "Junos OS", "range": ">= 24.2 / < 24.2R1-S2, 24.2R2" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "label": "CVE：juniper" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-21590", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA93446", "label": "CVE掲載の参考情報" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers", "label": "CVE掲載の参考情報" }, { "url": "https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21590", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-12T13:59:43.038Z", "modifiedAt": "2026-02-26T19:09:35.631Z", "fetchedAt": "2026-10-24T04:55:56.003Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.\n\nA local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device.\nThis issue is not exploitable from the Junos CLI.\nThis issue affects Junos OS: \n\n\n\n * All versions before 21.2R3-S9,\n * 21.4 versions before 21.4R3-S10, \n * 22.2 versions before 22.2R3-S6, \n * 22.4 versions before 22.4R3-S6, \n * 23.2 versions before 23.2R2-S3, \n * 23.4 versions before 23.4R2-S4,\n * 24.2 versions before 24.2R1-S2, 24.2R2.", "sourceTitle": "Junos OS: An local attacker with shell access can execute arbitrary code", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Junos OS", "vendor": "Juniper Networks", "versions": [ { "lessThan": "21.2R3-S9", "status": "affected", "version": "0", "versionType": "semver" }, { "lessThan": "21.4R3-S10", "status": "affected", "version": "21.4", "versionType": "semver" }, { "lessThan": "22.2R3-S6", "status": "affected", "version": "22.2", "versionType": "semver" }, { "lessThan": "22.4R3-S6", "status": "affected", "version": "22.4", "versionType": "semver" }, { "lessThan": "23.2R2-S3", "status": "affected", "version": "23.2", "versionType": "semver" }, { "lessThan": "23.4R2-S4", "status": "affected", "version": "23.4", "versionType": "semver" }, { "lessThan": "24.2R1-S2, 24.2R2", "status": "affected", "version": "24.2", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-21590", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "fetchedAt": "2026-10-24T04:55:56.003Z", "publishedAt": "2025-03-12T13:59:43.038Z", "modifiedAt": "2026-02-26T19:09:35.631Z", "state": "published", "provider": "juniper", "title": "Junos OS: An local attacker with shell access can execute arbitrary code", "descriptions": [ { "lang": "en", "value": "An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.\n\nA local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device.\nThis issue is not exploitable from the Junos CLI.\nThis issue affects Junos OS: \n\n\n\n * All versions before 21.2R3-S9,\n * 21.4 versions before 21.4R3-S10, \n * 22.2 versions before 22.2R3-S6, \n * 22.4 versions before 22.4R3-S6, \n * 23.2 versions before 23.2R2-S3, \n * 23.4 versions before 23.4R2-S4,\n * 24.2 versions before 24.2R1-S2, 24.2R2.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Juniper Networks", "product": "Junos OS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "21.2R3-S9", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "21.4", "lessThan": "21.4R3-S10", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "22.2", "lessThan": "22.2R3-S6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "22.4", "lessThan": "22.4R3-S6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "23.2", "lessThan": "23.2R2-S3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "23.4", "lessThan": "23.4R2-S4", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "24.2", "lessThan": "24.2R1-S2, 24.2R2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "The following software releases have been updated to resolve this specific issue: 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, 24.2R1-S2, 24.2R2, 24.4R1, and all subsequent releases.\n\n\n \n\n\nPlease note that this issue is not fixed for all platforms in the releases specified in the solution section.\n\n\nFor the following products the fix is only available in these releases:\n\n\nSRX300 Series   21.2R3-S9, 23.4R2-S5*, 24.4R1\n\n\nSRX550HM    22.2R3-S7*\n\n\nEX4300 Series     21.4R3-S11* (except EX4300-48MP which has fixes available as indicated in the solution)\n\n\nEX4600               21.4R3-S11* (except EX4650 which has fixes available as indicated in the solution)\n\n\nACX1000, ACX1100, ACX2100, ACX2200, ACX4000,\n\n\nACX500              21.2R3-S9\n\n\nMX104               21.2R3-S9\n\n\n* Future Release", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "It is strongly recommended to mitigate the risk of exploitation by restricting shell access to trusted users only.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [ { "lang": "en", "value": "At least one instance of malicious exploitation has been reported to the Juniper SIRT. Customers are encouraged to upgrade to a fixed release as soon as it's available and in the meantime take steps to mitigate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-653", "lang": "en", "description": "CWE-653 Improper Isolation or Compartmentalization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM", "provider": "juniper", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" }, { "version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "baseScore": 6.7, "baseSeverity": "MEDIUM", "provider": "juniper", "sourcePath": "/containers/cna/metrics/1/cvssV4_0" } ], "references": [ { "url": "https://supportportal.juniper.net/JSA93446", "label": "juniper", "tags": [ "vendor-advisory" ], "provider": "juniper", "sourcePath": "/containers/cna/references/0" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers", "label": "juniper", "tags": [ "third-party-advisory" ], "provider": "juniper", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21590", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"21.2R3-S9\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S10\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S6\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R3-S6\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"},{\"lessThan\":\"23.2R2-S3\",\"status\":\"affected\",\"version\":\"23.2\",\"versionType\":\"semver\"},{\"lessThan\":\"23.4R2-S4\",\"status\":\"affected\",\"version\":\"23.4\",\"versionType\":\"semver\"},{\"lessThan\":\"24.2R1-S2, 24.2R2\",\"status\":\"affected\",\"version\":\"24.2\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.\n\nA local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device.\nThis issue is not exploitable from the Junos CLI.\nThis issue affects Junos OS: \n\n\n\n * All versions before 21.2R3-S9,\n * 21.4 versions before 21.4R3-S10, \n * 22.2 versions before 22.2R3-S6, \n * 22.4 versions before 22.4R3-S6, \n * 23.2 versions before 23.2R2-S3, \n * 23.4 versions before 23.4R2-S4,\n * 24.2 versions before 24.2R1-S2, 24.2R2.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "The following software releases have been updated to resolve this specific issue: 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, 24.2R1-S2, 24.2R2, 24.4R1, and all subsequent releases.\n\n\n \n\n\nPlease note that this issue is not fixed for all platforms in the releases specified in the solution section.\n\n\nFor the following products the fix is only available in these releases:\n\n\nSRX300 Series   21.2R3-S9, 23.4R2-S5*, 24.4R1\n\n\nSRX550HM    22.2R3-S7*\n\n\nEX4300 Series     21.4R3-S11* (except EX4300-48MP which has fixes available as indicated in the solution)\n\n\nEX4600               21.4R3-S11* (except EX4650 which has fixes available as indicated in the solution)\n\n\nACX1000, ACX1100, ACX2100, ACX2200, ACX4000,\n\n\nACX500              21.2R3-S9\n\n\nMX104               21.2R3-S9\n\n\n* Future Release", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "It is strongly recommended to mitigate the risk of exploitation by restricting shell access to trusted users only.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "At least one instance of malicious exploitation has been reported to the Juniper SIRT. Customers are encouraged to upgrade to a fixed release as soon as it's available and in the meantime take steps to mitigate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-653\",\"description\":\"CWE-653 Improper Isolation or Compartmentalization\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"LOCAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"attackVector\":\"LOCAL\",\"baseScore\":6.7,\"baseSeverity\":\"MEDIUM\",\"privilegesRequired\":\"HIGH\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-21590:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590", "sourcePath": "retained:/originalText", "text": "Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-21590:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590", "modifiedAt": "2025-03-13T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:35.631Z", "fetchedAt": "2026-10-24T04:55:56.003Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-13T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Junos OSにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:55:56.003Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "47ee862c0ff8e0009f8a5a7854dbdfd88d2ba2da86af54ad67ef3673aade8052", "sourceModifiedAt": "2026-02-26T19:09:35.631Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Juniper Networks の Junos OS カーネルに不適切な分離・区画化の脆弱性があり、シェルにアクセスできるローカル攻撃者が任意のコードを注入してデバイスの完全性を侵害できる。この脆弱性は Junos CLI からは悪用できない。", "risk": "デバイスの完全性が侵害され、攻撃者が任意のコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "ローカル攻撃者で、シェルへのアクセス権を持っていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "高い特権（管理者権限）を有していること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "Junos CLI からはこの脆弱性は悪用できないこと。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Juniper Networks / Junos OS。影響ありとして記載：21.2R3-S9未満の版。影響ありとして記載：21.4以上、21.4R3-S10未満。影響ありとして記載：22.2以上、22.2R3-S6未満。影響ありとして記載：22.4以上、22.4R3-S6未満。影響ありとして記載：23.2以上、23.2R2-S3未満。影響ありとして記載：23.4以上、23.4R2-S4未満。影響ありとして記載：24.2以上、24.2R1-S2, 24.2R2未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json" ], "evidenceIds": [ "E4" ] }, { "text": "「Junos OS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-21590", "https://supportportal.juniper.net/JSA93446", "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590", "https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2025-21590" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "シェルへのアクセスを信頼できるユーザーのみに制限することが強く推奨される。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json" ], "evidenceIds": [ "E5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-21590", "https://supportportal.juniper.net/JSA93446", "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590", "https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2025-21590" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "label": "CVE：juniper" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-21590", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA93446", "label": "CVE掲載の参考情報" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers", "label": "CVE掲載の参考情報" }, { "url": "https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21590", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.\n\nA local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device.\nThis issue is not exploitable from the Junos CLI.\nThis issue affects Junos OS: \n\n\n\n * All versions before 21.2R3-S9,\n * 21.4 versions before 21.4R3-S10, \n * 22.2 versions before 22.2R3-S6, \n * 22.4 versions before 22.4R3-S6, \n * 23.2 versions before 23.2R2-S3, \n * 23.4 versions before 23.4R2-S4,\n * 24.2 versions before 24.2R1-S2, 24.2R2.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourceField": "/containers/cna/title", "excerpt": "Junos OS: An local attacker with shell access can execute arbitrary code", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590", "sourceField": "retained:/originalText", "excerpt": "Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"21.2R3-S9\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S10\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S6\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R3-S6\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"},{\"lessThan\":\"23.2R2-S3\",\"status\":\"affected\",\"version\":\"23.2\",\"versionType\":\"semver\"},{\"lessThan\":\"23.4R2-S4\",\"status\":\"affected\",\"version\":\"23.4\",\"versionType\":\"semver\"},{\"lessThan\":\"24.2R1-S2, 24.2R2\",\"status\":\"affected\",\"version\":\"24.2\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/21xxx/CVE-2025-21590.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "It is strongly recommended to mitigate the risk of exploitation by restricting shell access to trusted users only.", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-21590", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-21590\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-21590（Junos OS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ローカル攻撃者で、シェルへのアクセス権を持っていること。\n・高い特権（管理者権限）を有していること。\n・Junos CLI からはこの脆弱性は悪用できないこと。\n・公式の対象表：Juniper Networks / Junos OS。影響ありとして記載：21.2R3-S9未満の版。影響ありとして記載：21.4以上、21.4R3-S10未満。影響ありとして記載：22.2以上、22.2R3-S6未満。影響ありとして記載：22.4以上、22.4R3-S6未満。影響ありとして記載：23.2以上、23.2R2-S3未満。影響ありとして記載：23.4以上、23.4R2-S4未満。影響ありとして記載：24.2以上、24.2R1-S2, 24.2R2未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-21590", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:56.003Z", "lastSuccess": "2026-10-24T04:55:56.003Z", "sourceCheckedAt": "2026-10-24T04:55:56.003Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-24201", "aliases": [], "title": "Safari / iOS and iPadOS / iPadOS / macOS / visionOS / watchOS：脆弱性情報", "summary": "細工したウェブコンテンツが Web Content サンドボックスから抜け出す可能性があり、これを防止するためのチェックが強化され、Safari 18.3.1、iOS 15.8.4、iPadOS 15.8.4、iOS 16.7.11、iPadOS 16.7.11、iOS 18.3.2、iPadOS 18.3.2、iPadOS 17.7.6、macOS Sequoia 15.3.2、visionOS 2.3.2、watchOS 11.4 で修正されています。この修正は iOS 17.2 でブロックされた攻撃への補足的な対策です。", "risk": "サンドボックスから抜け出すことで、攻撃者がデバイス上で本来許可されていない操作を実行できる可能性があります。", "product": "Safari / iOS and iPadOS / iPadOS / macOS / visionOS / watchOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "Safari", "range": "< 18.3.1" }, { "product": "iOS and iPadOS", "range": "< 15.8.4" }, { "product": "iOS and iPadOS", "range": "< 16.7.11" }, { "product": "iOS and iPadOS", "range": "< 18.3.2" }, { "product": "iPadOS", "range": "< 17.7.6" }, { "product": "macOS", "range": "< 15.3.2" }, { "product": "visionOS", "range": "< 2.3.2" }, { "product": "watchOS", "range": "< 11.4" } ], "fixed": [], "steps": [ "細工したウェブコンテンツが Web Content サンドボックスから抜け出す可能性があり、これを防止するためのチェックが強化され、Safari 18.3.1、iOS 15.8.4、iPadOS 15.8.4、iOS 16.7.11、iPadOS 16.7.11、iOS 18.3.2、iPadOS 18.3.2、iPadOS 17.7.6、macOS Sequoia 15.3.2、visionOS 2.3.2、watchOS 11.4 で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24201", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/122281", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122283", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122284", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122285", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122345", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/122346", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/122372", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/122376", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24201", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-03-11T18:07:21.848Z", "modifiedAt": "2026-04-02T18:10:13.716Z", "fetchedAt": "2026-10-24T04:55:56.043Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "Safari", "versions": [ { "version": "0", "status": "affected", "lessThan": "18.3.1", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "15.8.4", "versionType": "custom" }, { "version": "0", "status": "affected", "lessThan": "16.7.11", "versionType": "custom" }, { "version": "0", "status": "affected", "lessThan": "18.3.2", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iPadOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "17.7.6", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "15.3.2", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "visionOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "2.3.2", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "watchOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "11.4", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-24201", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "fetchedAt": "2026-10-24T04:55:56.043Z", "publishedAt": "2025-03-11T18:07:21.848Z", "modifiedAt": "2026-04-02T18:10:13.716Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Apple", "product": "Safari", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "18.3.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThan": "15.8.4", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "0", "lessThan": "16.7.11", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "0", "lessThan": "18.3.2", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iPadOS", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "0", "lessThan": "17.7.6", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "0", "lessThan": "15.3.2", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "visionOS", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "0", "lessThan": "2.3.2", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "watchOS", "sourcePath": "/containers/cna/affected/5", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "0", "lessThan": "11.4", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/122281", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/0" }, { "url": "https://support.apple.com/en-us/122283", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/1" }, { "url": "https://support.apple.com/en-us/122284", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/2" }, { "url": "https://support.apple.com/en-us/122285", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/3" }, { "url": "https://support.apple.com/en-us/122345", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/4" }, { "url": "https://support.apple.com/en-us/122346", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/5" }, { "url": "https://support.apple.com/en-us/122372", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/6" }, { "url": "https://support.apple.com/en-us/122376", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/7" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24201", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://seclists.org/fulldisclosure/2025/Mar/2", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "http://seclists.org/fulldisclosure/2025/Mar/3", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "http://seclists.org/fulldisclosure/2025/Mar/4", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "http://seclists.org/fulldisclosure/2025/Mar/5", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/16", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/4" }, { "url": "http://seclists.org/fulldisclosure/2025/Oct/31", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/5" }, { "url": "http://seclists.org/fulldisclosure/2025/Oct/1", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/6" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/7" }, { "url": "http://seclists.org/fulldisclosure/2025/Jun/19", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/8" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/7", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/9" }, { "url": "https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/10" }, { "url": "https://github.com/cisagov/vulnrichment/issues/194", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/11" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.3.1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.8.4\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"16.7.11\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.3.2\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"17.7.6\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.3.2\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"2.3.2\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"11.4\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.)\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":10,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-24201:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201", "sourcePath": "retained:/originalText", "text": "Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-24201:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201", "modifiedAt": "2025-03-13T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-04-02T18:10:13.716Z", "fetchedAt": "2026-10-24T04:55:56.043Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-13T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Safari / iOS and iPadOS / iPadOS / macOS / visionOS / watchOSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:55:56.043Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "0529bc6c87a31584b4463a3e0de52e1dc7c7bc1ba3101de39b58e8743937d07a", "sourceModifiedAt": "2026-04-02T18:10:13.716Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "細工したウェブコンテンツが Web Content サンドボックスから抜け出す可能性があり、これを防止するためのチェックが強化され、Safari 18.3.1、iOS 15.8.4、iPadOS 15.8.4、iOS 16.7.11、iPadOS 16.7.11、iOS 18.3.2、iPadOS 18.3.2、iPadOS 17.7.6、macOS Sequoia 15.3.2、visionOS 2.3.2、watchOS 11.4 で修正されています。この修正は iOS 17.2 でブロックされた攻撃への補足的な対策です。", "risk": "サンドボックスから抜け出すことで、攻撃者がデバイス上で本来許可されていない操作を実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者が細工したウェブコンテンツをユーザーの Safari や WebKit を利用するブラウザーで表示させることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Apple / Safari。影響ありとして記載：18.3.1未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.8.4未満の版。影響ありとして記載：16.7.11未満の版。影響ありとして記載：18.3.2未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / iPadOS。影響ありとして記載：17.7.6未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：15.3.2未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Apple / visionOS。影響ありとして記載：2.3.2未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Apple / watchOS。影響ありとして記載：11.4未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201" ], "evidenceIds": [ "E8" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Safari / iOS and iPadOS / iPadOS / macOS / visionOS / watchOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-24201", "https://support.apple.com/en-us/122281", "https://support.apple.com/en-us/122283", "https://support.apple.com/en-us/122284", "https://support.apple.com/en-us/122285", "https://support.apple.com/en-us/122345", "https://support.apple.com/en-us/122346", "https://support.apple.com/en-us/122372", "https://support.apple.com/en-us/122376", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201", "https://nvd.nist.gov/vuln/detail/CVE-2025-24201" ] } ], "actions": [ { "text": "細工したウェブコンテンツが Web Content サンドボックスから抜け出す可能性があり、これを防止するためのチェックが強化され、Safari 18.3.1、iOS 15.8.4、iPadOS 15.8.4、iOS 16.7.11、iPadOS 16.7.11、iOS 18.3.2、iPadOS 18.3.2、iPadOS 17.7.6、macOS Sequoia 15.3.2、visionOS 2.3.2、watchOS 11.4 で修正されています。", "kind": "fix", "evidenceIds": [ "E1" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-24201", "https://support.apple.com/en-us/122281", "https://support.apple.com/en-us/122283", "https://support.apple.com/en-us/122284", "https://support.apple.com/en-us/122285", "https://support.apple.com/en-us/122345", "https://support.apple.com/en-us/122346", "https://support.apple.com/en-us/122372", "https://support.apple.com/en-us/122376", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201", "https://nvd.nist.gov/vuln/detail/CVE-2025-24201" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-24201", "https://support.apple.com/en-us/122281", "https://support.apple.com/en-us/122283", "https://support.apple.com/en-us/122284", "https://support.apple.com/en-us/122285", "https://support.apple.com/en-us/122345", "https://support.apple.com/en-us/122346", "https://support.apple.com/en-us/122372", "https://support.apple.com/en-us/122376", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201", "https://nvd.nist.gov/vuln/detail/CVE-2025-24201" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24201", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/122281", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122283", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122284", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122285", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/122345", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/122346", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/122372", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/122376", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24201", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.3.1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.8.4\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"16.7.11\",\"versionType\":\"custom\"},{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"18.3.2\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"17.7.6\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"15.3.2\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"2.3.2\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24201.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"11.4\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24201", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-24201\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-24201（Safari / iOS and iPadOS / iPadOS / macOS / visionOS / watchOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者が細工したウェブコンテンツをユーザーの Safari や WebKit を利用するブラウザーで表示させることが前提です。\n・公式の対象表：Apple / Safari。影響ありとして記載：18.3.1未満の版。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.8.4未満の版。影響ありとして記載：16.7.11未満の版。影響ありとして記載：18.3.2未満の版。\n・公式の対象表：Apple / iPadOS。影響ありとして記載：17.7.6未満の版。\n・公式の対象表：Apple / macOS。影響ありとして記載：15.3.2未満の版。\n・公式の対象表：Apple / visionOS。影響ありとして記載：2.3.2未満の版。\n・公式の対象表：Apple / watchOS。影響ありとして記載：11.4未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-24201", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:56.043Z", "lastSuccess": "2026-10-24T04:55:56.043Z", "sourceCheckedAt": "2026-10-24T04:55:56.043Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-24983", "aliases": [], "title": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows Server 2008 R2 Service Pack 1 / Windows Server 2008 R2 Service Pack 1 (Server Core installation) / Windows Server 2008 Service Pack 2 / Windows Server 2008 Service Pack 2 (Server Core instal：権限の奪取", "summary": "Windows Win32 カーネルサブシステムにおける Use‑After‑Free の脆弱性により、認可された攻撃者がローカルで権限を昇格させることができる。", "risk": "攻撃者がローカルでシステム上の権限を昇格させる可能性がある。", "product": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows Server 2008 R2 Service Pack 1 / Windows Server 2008 R2 Service Pack 1 (Server Core installation) / Windows Server 2008 Service Pack 2 / Windows Server 2008 Service Pack 2 (Server Core instal", "category": "windows", "component": "package", "severity": "high", "cvss": 7, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1507", "range": ">= 10.0.10240.0 / < 10.0.10240.20947（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.7876（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1", "range": ">= 6.1.7601.0 / < 6.1.7601.27618（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "range": ">= 6.1.7601.0 / < 6.1.7601.27618（環境: x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.23168（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "range": ">= 6.0.6003.0 / < 6.0.6003.23168（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.25368（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.25368（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.22470（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.22470（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.7876（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.7876（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24983", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24983", "label": "Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24983", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24983", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2025-03-11T16:59:17.608Z", "modifiedAt": "2026-02-26T19:09:39.770Z", "fetchedAt": "2026-10-24T04:55:57.257Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.10240.0", "lessThan": "10.0.10240.20947", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27618", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27618", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.23168", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.23168", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-24983", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "fetchedAt": "2026-10-24T04:55:57.257Z", "publishedAt": "2025-03-11T16:59:17.608Z", "modifiedAt": "2026-02-26T19:09:39.770Z", "state": "published", "provider": "microsoft", "title": "Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.10240.0", "lessThan": "10.0.10240.20947", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27618", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "sourcePath": "/containers/cna/affected/3", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27618", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/4", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.23168", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "sourcePath": "/containers/cna/affected/5", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.23168", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/6", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/7", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/9", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-416", "lang": "en-US", "description": "CWE-416: Use After Free", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 7, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24983", "label": "Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24983", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20947\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27618\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27618\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23168\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23168\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-416: Use After Free\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-416\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7,\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-24983:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983", "sourcePath": "retained:/originalText", "text": "Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-24983:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983", "modifiedAt": "2025-03-11T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:39.770Z", "fetchedAt": "2026-10-24T04:55:57.257Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-11T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows Server 2008 R2 Service Pack 1 / Windows Server 2008 R2 Service Pack 1 (Server Core installation) / Windows Server 2008 Service Pack 2 / Windows Server 2008 Service Pack 2 (Server Core instalに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:55:57.257Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "6ceda71ba898a170baa09c136ed5bdcd27e8a075f459af0908e05210e81fecb6", "sourceModifiedAt": "2026-02-26T19:09:39.770Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows Win32 カーネルサブシステムにおける Use‑After‑Free の脆弱性により、認可された攻撃者がローカルで権限を昇格させることができる。", "risk": "攻撃者がローカルでシステム上の権限を昇格させる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認可された攻撃者がローカルで実行できる環境において、Windows の Win32 カーネルサブシステムが対象となる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20947未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27618未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27618未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.23168未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.23168未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E14" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983" ], "evidenceIds": [ "E15" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2025-24983", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24983", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24983", "https://nvd.nist.gov/vuln/detail/CVE-2025-24983" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24983", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24983", "label": "Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24983", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24983", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/title", "excerpt": "Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20947\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27618\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27618\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23168\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23168\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24983.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-24983\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-24983（Windows 10 Version 1507 / Windows 10 Version 1607 / Windows Server 2008 R2 Service Pack 1 / Windows Server 2008 R2 Service Pack 1 (Server Core installation) / Windows Server 2008 Service Pack 2 / Windows Server 2008 Service Pack 2 (Server Core instal）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認可された攻撃者がローカルで実行できる環境において、Windows の Win32 カーネルサブシステムが対象となる。\n・公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20947未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27618未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27618未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.23168未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.23168未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-24983", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:55:57.257Z", "lastSuccess": "2026-10-24T04:55:57.257Z", "sourceCheckedAt": "2026-10-24T04:55:57.257Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-24984", "aliases": [], "title": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2：情報の漏えい", "summary": "Windows NTFS に機密情報がログファイルに書き込まれ、物理的な攻撃を行う未認可の攻撃者が情報を開示できる。", "risk": "攻撃者はヒープメモリの一部を読み取れる可能性がある。", "product": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2", "category": "windows", "component": "package", "severity": "medium", "cvss": 4.6, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1507", "range": ">= 10.0.10240.0 / < 10.0.10240.20947（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.7876（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.7009（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19044.0 / < 10.0.19044.5608（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.5608（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H2", "range": ">= 10.0.22621.0 / < 10.0.22621.5039（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H3", "range": ">= 10.0.22631.0 / < 10.0.22631.5039（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.5039（環境: x64-based Systems）" }, { "product": "Windows 11 Version 24H2", "range": ">= 10.0.26100.0 / < 10.0.26100.3476（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.25368（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.25368（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.22470（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.22470（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.7876（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.7876（環境: x64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.7009（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.7009（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.3328（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.1486（環境: x64-based Systems）" }, { "product": "Windows Server 2025", "range": ">= 10.0.26100.0 / < 10.0.26100.3476（環境: x64-based Systems）" }, { "product": "Windows Server 2025 (Server Core installation)", "range": ">= 10.0.26100.0 / < 10.0.26100.3476（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24984", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24984", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984", "label": "Windows NTFS Information Disclosure Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24984", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2025-03-11T16:59:18.193Z", "modifiedAt": "2026-02-26T19:09:39.622Z", "fetchedAt": "2026-10-24T04:56:05.261Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows NTFS Information Disclosure Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.10240.0", "lessThan": "10.0.10240.20947", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19044.0", "lessThan": "10.0.19044.5608", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.5608", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22621.0", "lessThan": "10.0.22621.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.3328", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.1486", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-24984", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "fetchedAt": "2026-10-24T04:56:05.261Z", "publishedAt": "2025-03-11T16:59:18.193Z", "modifiedAt": "2026-02-26T19:09:39.622Z", "state": "published", "provider": "microsoft", "title": "Windows NTFS Information Disclosure Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24984", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.10240.0", "lessThan": "10.0.10240.20947", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/3", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.19044.0", "lessThan": "10.0.19044.5608", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/4", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.5608", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.22621.0", "lessThan": "10.0.22621.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "sourcePath": "/containers/cna/affected/6", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/7", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/9", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/12", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/13", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/14", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.3328", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.1486", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-532", "lang": "en-US", "description": "CWE-532: Insertion of Sensitive Information into Log File", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C", "baseScore": 4.6, "baseSeverity": "MEDIUM", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984", "label": "Windows NTFS Information Disclosure Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24984", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20947\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.5608\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.5608\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.3328\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.1486\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-532: Insertion of Sensitive Information into Log File\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-532\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":4.6,\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-24984:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24984", "sourcePath": "retained:/originalText", "text": "Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-24984:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24984", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24984", "modifiedAt": "2025-03-11T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:39.622Z", "fetchedAt": "2026-10-24T04:56:05.261Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-11T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2に情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:56:05.261Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b89ead92ae71602f5fc12acd31dbedb33b3257ba2416c9432d3f30d5306154da", "sourceModifiedAt": "2026-02-26T19:09:39.622Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows NTFS に機密情報がログファイルに書き込まれ、物理的な攻撃を行う未認可の攻撃者が情報を開示できる。", "risk": "攻撃者はヒープメモリの一部を読み取れる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "攻撃者が未認可であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者が物理的にアクセスできること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20947未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.5608未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.5608未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.5039未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.5039未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.5039未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.3328未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.1486未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E23" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E24" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24984" ], "evidenceIds": [ "E25" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E4" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2025-24984", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24984", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984", "https://nvd.nist.gov/vuln/detail/CVE-2025-24984" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json" ], "evidenceIds": [ "E4" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24984", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24984", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984", "label": "Windows NTFS Information Disclosure Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24984", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/title", "excerpt": "Windows NTFS Information Disclosure Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24984", "sourceField": "retained:/originalText", "excerpt": "Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20947\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.5608\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.5608\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.3328\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.1486\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24984.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24984", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-24984\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-24984（Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者が未認可であること。\n・攻撃者が物理的にアクセスできること。\n・公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20947未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.5608未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.5608未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.5039未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.5039未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.5039未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.3328未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.1486未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-24984", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:56:05.261Z", "lastSuccess": "2026-10-24T04:56:05.261Z", "sourceCheckedAt": "2026-10-24T04:56:05.261Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-24985", "aliases": [], "title": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2：コード実行", "summary": "Windows Fast FAT ドライバーの整数オーバーフローまたはラップアラウンドにより、認可されていない攻撃者がローカルでコードを実行できるようになります。", "risk": "攻撃者は対象システム上で任意のコードを実行できる可能性があります。", "product": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2", "category": "windows", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1507", "range": ">= 10.0.10240.0 / < 10.0.10240.20947（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.7876（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.7009（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19044.0 / < 10.0.19044.5608（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.5608（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H2", "range": ">= 10.0.22621.0 / < 10.0.22621.5039（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H3", "range": ">= 10.0.22631.0 / < 10.0.22631.5039（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.5039（環境: x64-based Systems）" }, { "product": "Windows 11 Version 24H2", "range": ">= 10.0.26100.0 / < 10.0.26100.3476（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1", "range": ">= 6.1.7601.0 / < 6.1.7601.27618（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "range": ">= 6.1.7601.0 / < 6.1.7601.27618（環境: x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.23168（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "range": ">= 6.0.6003.0 / < 6.0.6003.23168（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.25368（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.25368（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.22470（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.22470（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.7876（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.7876（環境: x64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.7009（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.7009（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.3328（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.1486（環境: x64-based Systems）" }, { "product": "Windows Server 2025", "range": ">= 10.0.26100.0 / < 10.0.26100.3476（環境: x64-based Systems）" }, { "product": "Windows Server 2025 (Server Core installation)", "range": ">= 10.0.26100.0 / < 10.0.26100.3476（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24985", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24985", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24985", "label": "Windows Fast FAT File System Driver Remote Code Execution Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24985", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2025-03-11T16:59:18.750Z", "modifiedAt": "2026-02-26T19:09:39.435Z", "fetchedAt": "2026-10-24T04:56:11.231Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows Fast FAT File System Driver Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.10240.0", "lessThan": "10.0.10240.20947", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19044.0", "lessThan": "10.0.19044.5608", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.5608", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22621.0", "lessThan": "10.0.22621.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27618", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27618", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.23168", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.23168", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.3328", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.1486", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-24985", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "fetchedAt": "2026-10-24T04:56:11.231Z", "publishedAt": "2025-03-11T16:59:18.750Z", "modifiedAt": "2026-02-26T19:09:39.435Z", "state": "published", "provider": "microsoft", "title": "Windows Fast FAT File System Driver Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24985", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.10240.0", "lessThan": "10.0.10240.20947", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/3", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.19044.0", "lessThan": "10.0.19044.5608", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/4", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.5608", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.22621.0", "lessThan": "10.0.22621.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "sourcePath": "/containers/cna/affected/6", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/7", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.5039", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "sourcePath": "/containers/cna/affected/9", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27618", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27618", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/11", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.23168", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "sourcePath": "/containers/cna/affected/12", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.23168", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/13", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/14", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25368", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22470", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7876", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.7009", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/21", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/21/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.3328", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/22", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/22/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.1486", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "sourcePath": "/containers/cna/affected/23", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/23/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "sourcePath": "/containers/cna/affected/24", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/24/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.3476", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-190", "lang": "en-US", "description": "CWE-190: Integer Overflow or Wraparound", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-122", "lang": "en-US", "description": "CWE-122: Heap-based Buffer Overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/1" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24985", "label": "Windows Fast FAT File System Driver Remote Code Execution Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24985", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24985-integer-overflow-vulnerability-in-microsoft-windows-fast-fat-driver-mitigation-script", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24985-integer-overflow-vulnerability-in-microsoft-windows-fast-fat-driver-detection-script", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20947\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.5608\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.5608\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27618\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27618\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23168\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23168\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/21", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.3328\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/22", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.1486\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/23", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/affected/24", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-190: Integer Overflow or Wraparound\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-190\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/1", "text": "{\"description\":\"CWE-122: Heap-based Buffer Overflow\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-122\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2025-24985:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24985", "sourcePath": "retained:/originalText", "text": "Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2025-24985:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24985", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24985", "modifiedAt": "2025-03-11T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T19:09:39.435Z", "fetchedAt": "2026-10-24T04:56:11.231Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2025-03-11T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2にコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T04:56:11.231Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f65ac12d12e40368396a0cf0887fd746e3bfb7aad7e070bfd263da3dbc22fcef", "sourceModifiedAt": "2026-02-26T19:09:39.435Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows Fast FAT ドライバーの整数オーバーフローまたはラップアラウンドにより、認可されていない攻撃者がローカルでコードを実行できるようになります。", "risk": "攻撃者は対象システム上で任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認可されていない攻撃者が特別な権限や設定なしにこの脆弱性を利用できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20947未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.5608未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.5608未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.5039未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.5039未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.5039未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27618未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27618未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.23168未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.23168未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E23" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.3328未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E24" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.1486未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E25" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E26" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E27" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24985" ], "evidenceIds": [ "E28" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2025-24985", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24985", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24985", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985", "https://nvd.nist.gov/vuln/detail/CVE-2025-24985" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24985", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-24985", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24985", "label": "Windows Fast FAT File System Driver Remote Code Execution Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24985", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/title", "excerpt": "Windows Fast FAT File System Driver Remote Code Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20947\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.5608\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.5608\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.5039\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27618\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27618\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23168\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23168\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25368\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22470\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7876\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.7009\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/21", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.3328\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/22", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.1486\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E26", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/23", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E27", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/24xxx/CVE-2025-24985.json", "sourceField": "/containers/cna/affected/24", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.3476\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E28", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24985", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-24985\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-24985（Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認可されていない攻撃者が特別な権限や設定なしにこの脆弱性を利用できます。\n・公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20947未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.5608未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.5608未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.5039未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.5039未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.5039未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27618未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27618未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.23168未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.23168未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25368未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22470未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7876未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.7009未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.3328未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.1486未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.3476未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-24985", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T04:56:11.231Z", "lastSuccess": "2026-10-24T04:56:11.231Z", "sourceCheckedAt": "2026-10-24T04:56:11.231Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } } ], "total": 2264, "limit": 20, "offset": 920, "filters": { "product": "all", "type": "all", "q": "", "page": 47 }, "pagination": { "page": 47, "pageSize": 20, "totalPages": 114 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-24T14:17:49.528Z", "lastAttempt": "2026-10-24T14:17:49.528Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "error", "lastSuccess": "2026-10-24T12:17:52.875Z", "lastAttempt": "2026-10-24T14:17:49.528Z", "error": "GitHub API取得上限に到達 (2026-10-24T14:32:16.000Z以降に再取得)", "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-24T14:17:49.528Z", "lastAttempt": "2026-10-24T14:17:49.528Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "partial", "lastSuccess": "2026-10-24T12:17:52.875Z", "lastAttempt": "2026-10-24T14:17:49.528Z", "error": "未確認のページ・期間は次回の定期取得で続きから反映します。", "recordCount": 8, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-24T12:02:52.875Z 〜 2026-10-24T13:17:49.742Z、全製品の変更 1000/1237件まで確認、対象8件反映。", "cursor": { "start": "2026-10-24T12:02:52.875Z", "end": "2026-10-24T13:17:49.742Z", "kind": "modified", "index": 1000 }, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "error", "lastSuccess": "2026-10-24T12:17:52.875Z", "lastAttempt": "2026-10-24T14:17:49.528Z", "error": "HTTP 404", "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }