{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2024-12356", "aliases": [], "title": "Remote Support / Privileged Remote Access：脆弱性情報", "summary": "Privileged Remote Access（PRA）および Remote Support（RS）製品に重大な脆弱性が見つかり、認証されていない攻撃者がコマンドを注入して、サイトのユーザーとして実行させることができます。", "risk": "攻撃者が注入したコマンドがサイトのユーザー権限で実行される可能性があります。", "product": "Remote Support / Privileged Remote Access", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "BT", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Remote Support", "range": "<= 24.3.1" }, { "product": "Privileged Remote Access", "range": "<= 24.3.1" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2024-12356」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "label": "CVE：BT" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-12356", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12356", "label": "CISAが示す関連情報" }, { "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-12-17T04:29:07.883Z", "modifiedAt": "2025-10-21T22:55:34.239Z", "fetchedAt": "2026-10-24T05:04:00.125Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.", "sourceTitle": "Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Remote Support", "vendor": "BeyondTrust", "versions": [ { "lessThanOrEqual": "24.3.1", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "Privileged Remote Access", "vendor": "BeyondTrust", "versions": [ { "lessThanOrEqual": "24.3.1", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-12356", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "fetchedAt": "2026-10-24T05:04:00.125Z", "publishedAt": "2024-12-17T04:29:07.883Z", "modifiedAt": "2025-10-21T22:55:34.239Z", "state": "published", "provider": "BT", "title": "Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)", "descriptions": [ { "lang": "en", "value": "A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "BeyondTrust", "product": "Remote Support", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "24.3.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "BeyondTrust", "product": "Privileged Remote Access", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThanOrEqual": "24.3.1", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "BT", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.cve.org/CVERecord?id=CVE-2024-12356", "label": "BT", "tags": [], "provider": "BT", "sourcePath": "/containers/cna/references/0" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12356", "label": "BT", "tags": [], "provider": "BT", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "label": "BT", "tags": [], "provider": "BT", "sourcePath": "/containers/cna/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12356", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Remote Support\",\"vendor\":\"BeyondTrust\",\"versions\":[{\"lessThanOrEqual\":\"24.3.1\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Privileged Remote Access\",\"vendor\":\"BeyondTrust\",\"versions\":[{\"lessThanOrEqual\":\"24.3.1\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-77\",\"description\":\"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-12356:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356", "sourcePath": "retained:/originalText", "text": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-12356:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356", "modifiedAt": "2024-12-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:34.239Z", "fetchedAt": "2026-10-24T05:04:00.125Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Remote Support / Privileged Remote Accessに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:04:00.125Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "09221eedf773ee153151ca83334d3f25042651a9d808e1936c93c169427aaadc", "sourceModifiedAt": "2025-10-21T22:55:34.239Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Privileged Remote Access（PRA）および Remote Support（RS）製品に重大な脆弱性が見つかり、認証されていない攻撃者がコマンドを注入して、サイトのユーザーとして実行させることができます。", "risk": "攻撃者が注入したコマンドがサイトのユーザー権限で実行される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されていない攻撃者が、サイトのユーザーとして実行されるコマンドを注入できる状況。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：BeyondTrust / Remote Support。影響ありとして記載：24.3.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：BeyondTrust / Privileged Remote Access。影響ありとして記載：24.3.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Remote Support / Privileged Remote Access」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-12356", "https://nvd.nist.gov/vuln/detail/CVE-2024-12356", "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356" ], "evidenceIds": [ "E5" ] }, { "text": "「CVE-2024-12356」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-12356", "https://nvd.nist.gov/vuln/detail/CVE-2024-12356", "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-12356", "https://nvd.nist.gov/vuln/detail/CVE-2024-12356", "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-12356", "https://nvd.nist.gov/vuln/detail/CVE-2024-12356", "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-12356", "https://nvd.nist.gov/vuln/detail/CVE-2024-12356", "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "label": "CVE：BT" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-12356", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12356", "label": "CISAが示す関連情報" }, { "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "sourceField": "/containers/cna/title", "excerpt": "Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Remote Support\",\"vendor\":\"BeyondTrust\",\"versions\":[{\"lessThanOrEqual\":\"24.3.1\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12356.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Privileged Remote Access\",\"vendor\":\"BeyondTrust\",\"versions\":[{\"lessThanOrEqual\":\"24.3.1\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-12356", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-12356\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-12356（Remote Support / Privileged Remote Access）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者が、サイトのユーザーとして実行されるコマンドを注入できる状況。\n・公式の対象表：BeyondTrust / Remote Support。影響ありとして記載：24.3.1以下の版。\n・公式の対象表：BeyondTrust / Privileged Remote Access。影響ありとして記載：24.3.1以下の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-12356", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:04:00.125Z", "lastSuccess": "2026-10-24T05:04:00.125Z", "sourceCheckedAt": "2026-10-24T05:04:00.125Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2018-14933", "aliases": [], "title": "n/a：脆弱性情報", "summary": "NUUO NVRmini デバイスの upgrade_handle.php において、writeuploaddir コマンドの uploaddir パラメータにシェルのメタ文字を含めることで、リモートからコマンドを実行できる脆弱性があります。", "risk": "攻撃者がこの脆弱性を利用すると、デバイス上で任意の OS コマンドを実行でき、システムが乗っ取られる可能性があります。", "product": "NUUO NVRmini Devices", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "対象製品は既に製品寿命が終了しているため、使用を中止してください。", "「CVE-2018-14933」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2018-14933", "label": "CVE公式レコード" }, { "url": "https://www.exploit-db.com/exploits/45070/", "label": "45070" }, { "url": "https://www.exploit-db.com/exploits/46340/", "label": "46340" }, { "url": "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14933", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2018-08-04T19:00:00.000Z", "modifiedAt": "2025-10-21T23:45:49.231Z", "fetchedAt": "2026-10-24T05:04:00.274Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2018-14933", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json", "fetchedAt": "2026-10-24T05:04:00.274Z", "publishedAt": "2018-08-04T19:00:00.000Z", "modifiedAt": "2025-10-21T23:45:49.231Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.exploit-db.com/exploits/45070/", "label": "45070", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.exploit-db.com/exploits/46340/", "label": "46340", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14933", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2018-14933:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "sourcePath": "retained:/originalText", "text": "NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2018-14933:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "sourcePath": "retained:/sourceAction", "text": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "modifiedAt": "2024-12-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:45:49.231Z", "fetchedAt": "2026-10-24T05:04:00.274Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:04:00.274Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "78c835e82fe3dfbe40109687b50da221f75887a89b347adf8d893df5ec5108de", "sourceModifiedAt": "2025-10-21T23:45:49.231Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "NUUO NVRmini デバイスの upgrade_handle.php において、writeuploaddir コマンドの uploaddir パラメータにシェルのメタ文字を含めることで、リモートからコマンドを実行できる脆弱性があります。", "risk": "攻撃者がこの脆弱性を利用すると、デバイス上で任意の OS コマンドを実行でき、システムが乗っ取られる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "writeuploaddir コマンドの uploaddir パラメータにシェルメタ文字を含めてリクエストできることが前提条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json" ], "evidenceIds": [ "E3" ] }, { "text": "「NUUO NVRmini Devices」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2018-14933", "https://www.exploit-db.com/exploits/45070/", "https://www.exploit-db.com/exploits/46340/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2018-14933" ] } ], "actions": [ { "text": "対象製品は既に製品寿命が終了しているため、使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2018-14933」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2018-14933", "https://www.exploit-db.com/exploits/45070/", "https://www.exploit-db.com/exploits/46340/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2018-14933" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2018-14933", "https://www.exploit-db.com/exploits/45070/", "https://www.exploit-db.com/exploits/46340/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2018-14933" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2018-14933", "https://www.exploit-db.com/exploits/45070/", "https://www.exploit-db.com/exploits/46340/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2018-14933" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2018-14933", "https://www.exploit-db.com/exploits/45070/", "https://www.exploit-db.com/exploits/46340/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2018-14933" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2018-14933", "label": "CVE公式レコード" }, { "url": "https://www.exploit-db.com/exploits/45070/", "label": "45070" }, { "url": "https://www.exploit-db.com/exploits/46340/", "label": "46340" }, { "url": "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14933", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "sourceField": "retained:/originalText", "excerpt": "NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2018/14xxx/CVE-2018-14933.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "sourceField": "retained:/sourceAction", "excerpt": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2018-14933\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2018-14933（NUUO NVRmini Devices）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・writeuploaddir コマンドの uploaddir パラメータにシェルメタ文字を含めてリクエストできることが前提条件です。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2018-14933", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:04:00.274Z", "lastSuccess": "2026-10-24T05:04:00.274Z", "sourceCheckedAt": "2026-10-24T05:04:00.274Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2019-11001", "aliases": [], "title": "n/a：脆弱性情報", "summary": "Reolink RLC-410W、C1 Pro、C2 Pro、RLC-422W、RLC-511W の各カメラ（バージョン 1.0.227 まで）において、認証済みの管理者が「TestEmail」機能の addr1 フィールドにシェルメタ文字を入れると、OS コマンドを root 権限で実行できる脆弱性があります。", "risk": "攻撃者は管理者権限で OS コマンドを root として実行できるため、カメラのシステム全体を制御されたり、ネットワーク内の他の機器に影響を与える可能性があります。", "product": "Reolink Multiple IP Cameras", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-11001", "label": "CVE公式レコード" }, { "url": "https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py", "label": "CVE掲載の参考情報" }, { "url": "https://reolink.com/product-eol/", "label": "CISAが示す関連情報" }, { "url": "https://reolink.com/download-center/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11001", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2019-04-08T17:00:21.000Z", "modifiedAt": "2025-10-21T23:45:40.747Z", "fetchedAt": "2026-10-24T06:08:10.333Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the \"TestEmail\" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2019-11001", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json", "fetchedAt": "2026-10-24T06:08:10.333Z", "publishedAt": "2019-04-08T17:00:21.000Z", "modifiedAt": "2025-10-21T23:45:40.747Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the \"TestEmail\" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the \"TestEmail\" functionality to inject and run OS commands as root.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11001", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the \"TestEmail\" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.2,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2019-11001:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "sourcePath": "retained:/originalText", "text": "Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the \"TestEmail\" functionality to inject and run OS commands as root.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2019-11001:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "sourcePath": "retained:/sourceAction", "text": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "modifiedAt": "2024-12-18T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:45:40.747Z", "fetchedAt": "2026-10-24T06:08:10.333Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-18T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:08:10.333Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3756890b8a114247bd0cad6e5481e2ffb8fa5080cdd741eac7c8ed0d0f8c0c28", "sourceModifiedAt": "2025-10-21T23:45:40.747Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Reolink RLC-410W、C1 Pro、C2 Pro、RLC-422W、RLC-511W の各カメラ（バージョン 1.0.227 まで）において、認証済みの管理者が「TestEmail」機能の addr1 フィールドにシェルメタ文字を入れると、OS コマンドを root 権限で実行できる脆弱性があります。", "risk": "攻撃者は管理者権限で OS コマンドを root として実行できるため、カメラのシステム全体を制御されたり、ネットワーク内の他の機器に影響を与える可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "認証済みの管理者が「TestEmail」機能を使用し、addr1 フィールドにシェルメタ文字を入力できる環境。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Reolink Multiple IP Cameras」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-11001", "https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/", "https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "https://reolink.com/product-eol/", "https://reolink.com/download-center/", "https://nvd.nist.gov/vuln/detail/CVE-2019-11001" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "現在有効な緩和策がない場合は、製品の使用を中止すべきです。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001" ], "evidenceIds": [ "E4" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2019-11001", "https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/", "https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "https://reolink.com/product-eol/", "https://reolink.com/download-center/", "https://nvd.nist.gov/vuln/detail/CVE-2019-11001" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2019-11001", "label": "CVE公式レコード" }, { "url": "https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py", "label": "CVE掲載の参考情報" }, { "url": "https://reolink.com/product-eol/", "label": "CISAが示す関連情報" }, { "url": "https://reolink.com/download-center/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11001", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the \"TestEmail\" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "sourceField": "retained:/originalText", "excerpt": "Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the \"TestEmail\" functionality to inject and run OS commands as root.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2019/11xxx/CVE-2019-11001.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "sourceField": "retained:/sourceAction", "excerpt": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11001", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2019-11001\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2019-11001（Reolink Multiple IP Cameras）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証済みの管理者が「TestEmail」機能を使用し、addr1 フィールドにシェルメタ文字を入力できる環境。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2019-11001", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:08:10.333Z", "lastSuccess": "2026-10-24T06:08:10.333Z", "sourceCheckedAt": "2026-10-24T06:08:10.333Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2021-40407", "aliases": [], "title": "n/a：コード実行", "summary": "Reolink RLC-410W IP カメラのファームウェア v3.0.0.136_20121102 のネットワーク設定機能において、SetDdns API で渡される domain パラメータが適切に検証されず、OS コマンドが注入される脆弱性が存在します。攻撃者は HTTP リクエストを送るだけでこの脆弱性を利用できます。", "risk": "この脆弱性が悪用されると、攻撃者はカメラが動作している OS 上で任意のコマンドを実行できる可能性があります。", "product": "Reolink RLC-410W IP Camera", "category": "other", "component": "package", "severity": "critical", "cvss": 9.1, "cvssVersion": "3.0", "cvssSource": "talos", "cvssVector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json", "label": "CVE：talos" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-40407", "label": "CVE公式レコード" }, { "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424", "label": "CVE掲載の参考情報" }, { "url": "https://reolink.com/product-eol/", "label": "CISAが示す関連情報" }, { "url": "https://reolink.com/download-center/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40407", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2022-01-28T19:10:13.000Z", "modifiedAt": "2025-10-21T23:15:48.390Z", "fetchedAt": "2026-10-24T05:04:07.339Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2021-40407", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json", "fetchedAt": "2026-10-24T05:04:07.339Z", "publishedAt": "2022-01-28T19:10:13.000Z", "modifiedAt": "2025-10-21T23:15:48.390Z", "state": "published", "provider": "talos", "title": "", "descriptions": [ { "lang": "en", "value": "An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "provider": "talos", "sourcePath": "/containers/cna/metrics/0/cvssV3_0" } ], "references": [ { "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40407", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-78\",\"description\":\"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"version\":\"3.0\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2021-40407:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "sourcePath": "retained:/originalText", "text": "Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2021-40407:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "sourcePath": "retained:/sourceAction", "text": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "modifiedAt": "2024-12-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:15:48.390Z", "fetchedAt": "2026-10-24T05:04:07.339Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:04:07.339Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a62f107c70b45e21c0adfeb2bd643072d05c0c16e3cff62aa8e1881a728cf24e", "sourceModifiedAt": "2025-10-21T23:15:48.390Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Reolink RLC-410W IP カメラのファームウェア v3.0.0.136_20121102 のネットワーク設定機能において、SetDdns API で渡される domain パラメータが適切に検証されず、OS コマンドが注入される脆弱性が存在します。攻撃者は HTTP リクエストを送るだけでこの脆弱性を利用できます。", "risk": "この脆弱性が悪用されると、攻撃者はカメラが動作している OS 上で任意のコマンドを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "攻撃者は認証された状態である必要があります。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407" ], "evidenceIds": [ "E2" ] }, { "text": "対象は Reolink RLC-410W IP カメラのファームウェア v3.0.0.136_20121102 で、ネットワーク設定機能（DDNS 設定）を使用できる環境です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃は SetDdns API の domain パラメータに対して HTTP リクエストを送信することで実行できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Reolink RLC-410W IP Camera」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-40407", "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "https://reolink.com/product-eol/", "https://reolink.com/download-center/", "https://nvd.nist.gov/vuln/detail/CVE-2021-40407" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "本製品が廃止（EoL/EoS）状態であり、現在利用可能な緩和策がない場合は、製品の使用を中止すべきです。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407" ], "evidenceIds": [ "E4" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-40407", "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "https://reolink.com/product-eol/", "https://reolink.com/download-center/", "https://nvd.nist.gov/vuln/detail/CVE-2021-40407" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json", "label": "CVE：talos" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-40407", "label": "CVE公式レコード" }, { "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424", "label": "CVE掲載の参考情報" }, { "url": "https://reolink.com/product-eol/", "label": "CISAが示す関連情報" }, { "url": "https://reolink.com/download-center/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40407", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "sourceField": "retained:/originalText", "excerpt": "Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/40xxx/CVE-2021-40407.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "sourceField": "retained:/sourceAction", "excerpt": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40407", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2021-40407\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2021-40407（Reolink RLC-410W IP Camera）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者は認証された状態である必要があります。\n・対象は Reolink RLC-410W IP カメラのファームウェア v3.0.0.136_20121102 で、ネットワーク設定機能（DDNS 設定）を使用できる環境です。\n・攻撃は SetDdns API の domain パラメータに対して HTTP リクエストを送信することで実行できます。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2021-40407", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:04:07.339Z", "lastSuccess": "2026-10-24T05:04:07.339Z", "sourceCheckedAt": "2026-10-24T05:04:07.339Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2022-23227", "aliases": [], "title": "n/a：脆弱性情報", "summary": "NUUO NVRmini2（バージョン3.11まで）では、認証されていない攻撃者が暗号化されたTARアーカイブをアップロードでき、handle_import_user.php に認証がないため任意のユーザーを追加できる。また、別の脆弱性（CVE-2011-5325）と組み合わせると、Web ルート下の任意のファイルを書き換えて root 権限でコードを実行できる。", "risk": "攻撃者が root 権限でコードを実行できる可能性がある。", "product": "NUUO NVRmini2 Devices", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "対象製品は既に製造終了（EoL）またはサービス終了（EoS）となっているため、使用を中止すべきである。", "「CVE-2022-23227」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-23227", "label": "CVE公式レコード" }, { "url": "https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/rapid7/metasploit-framework/pull/16044", "label": "CVE掲載の参考情報" }, { "url": "https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=29936569", "label": "CVE掲載の参考情報" }, { "url": "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23227", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2022-01-14T17:13:57.000Z", "modifiedAt": "2025-10-21T23:15:48.977Z", "fetchedAt": "2026-10-24T06:08:48.221Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2022-23227", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json", "fetchedAt": "2026-10-24T06:08:48.221Z", "publishedAt": "2022-01-14T17:13:57.000Z", "modifiedAt": "2025-10-21T23:15:48.977Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/rapid7/metasploit-framework/pull/16044", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://news.ycombinator.com/item?id=29936569", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23227", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2022-23227:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "sourcePath": "retained:/originalText", "text": "NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2022-23227:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "sourcePath": "retained:/sourceAction", "text": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "modifiedAt": "2024-12-18T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:15:48.977Z", "fetchedAt": "2026-10-24T06:08:48.221Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-18T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:08:48.221Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a77df37d8aae411a0ee7ab4e2b77fe63248947cb4ed2f180bd0eed55eb08ce14", "sourceModifiedAt": "2025-10-21T23:15:48.977Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "NUUO NVRmini2（バージョン3.11まで）では、認証されていない攻撃者が暗号化されたTARアーカイブをアップロードでき、handle_import_user.php に認証がないため任意のユーザーを追加できる。また、別の脆弱性（CVE-2011-5325）と組み合わせると、Web ルート下の任意のファイルを書き換えて root 権限でコードを実行できる。", "risk": "攻撃者が root 権限でコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されていない攻撃者が暗号化されたTARアーカイブをアップロードでき、handle_import_user.php に認証がないことが前提条件である。また、CVE-2011-5325 の脆弱性と組み合わせることで、Web ルート下の任意のファイルを書き換え、root 権限でコード実行が可能になる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json" ], "evidenceIds": [ "E3" ] }, { "text": "「NUUO NVRmini2 Devices」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2022-23227", "https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd", "https://github.com/rapid7/metasploit-framework/pull/16044", "https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device", "https://news.ycombinator.com/item?id=29936569", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2022-23227" ] } ], "actions": [ { "text": "対象製品は既に製造終了（EoL）またはサービス終了（EoS）となっているため、使用を中止すべきである。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2022-23227」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2022-23227", "https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd", "https://github.com/rapid7/metasploit-framework/pull/16044", "https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device", "https://news.ycombinator.com/item?id=29936569", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2022-23227" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2022-23227", "https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd", "https://github.com/rapid7/metasploit-framework/pull/16044", "https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device", "https://news.ycombinator.com/item?id=29936569", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2022-23227" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2022-23227", "https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd", "https://github.com/rapid7/metasploit-framework/pull/16044", "https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device", "https://news.ycombinator.com/item?id=29936569", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2022-23227" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2022-23227", "https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd", "https://github.com/rapid7/metasploit-framework/pull/16044", "https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device", "https://news.ycombinator.com/item?id=29936569", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2022-23227" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-23227", "label": "CVE公式レコード" }, { "url": "https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/rapid7/metasploit-framework/pull/16044", "label": "CVE掲載の参考情報" }, { "url": "https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device", "label": "CVE掲載の参考情報" }, { "url": "https://news.ycombinator.com/item?id=29936569", "label": "CVE掲載の参考情報" }, { "url": "https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23227", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "sourceField": "retained:/originalText", "excerpt": "NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/23xxx/CVE-2022-23227.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "sourceField": "retained:/sourceAction", "excerpt": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2022-23227\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2022-23227（NUUO NVRmini2 Devices）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者が暗号化されたTARアーカイブをアップロードでき、handle_import_user.php に認証がないことが前提条件である。また、CVE-2011-5325 の脆弱性と組み合わせることで、Web ルート下の任意のファイルを書き換え、root 権限でコード実行が可能になる。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2022-23227", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:08:48.221Z", "lastSuccess": "2026-10-24T06:08:48.221Z", "sourceCheckedAt": "2026-10-24T06:08:48.221Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-55956", "aliases": [], "title": "n/a：脆弱性情報", "summary": "Cleo Harmony、VLTrader、LexiCom の各製品（バージョン 5.8.0.24 未満）において、認証されていないユーザーが Autorun ディレクトリの既定設定を利用して任意の Bash または PowerShell コマンドをホストシステムにインポートし実行できる。", "risk": "攻撃者はホストシステム上で任意のシェルコマンドを実行できるようになる。", "product": "Cleo Multiple Products", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "「CVE-2024-55956」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-55956", "label": "CVE公式レコード" }, { "url": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending", "label": "CVE掲載の参考情報" }, { "url": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55956", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-12-13T00:00:00.000Z", "modifiedAt": "2026-08-05T03:55:58.257Z", "fetchedAt": "2026-10-24T06:09:02.275Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-55956", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json", "fetchedAt": "2026-10-24T06:09:02.275Z", "publishedAt": "2024-12-13T00:00:00.000Z", "modifiedAt": "2026-08-05T03:55:58.257Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55956", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"text\",\"lang\":\"en\",\"description\":\"n/a\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-55956:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "sourcePath": "retained:/originalText", "text": "Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-55956:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "modifiedAt": "2024-12-17T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-05T03:55:58.257Z", "fetchedAt": "2026-10-24T06:09:02.275Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-17T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:09:02.275Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a9f0d00ebfe1f2d283c93a8bdcab7ac2c559b4b3b057224becdf1bd1422f2346", "sourceModifiedAt": "2026-08-05T03:55:58.257Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cleo Harmony、VLTrader、LexiCom の各製品（バージョン 5.8.0.24 未満）において、認証されていないユーザーが Autorun ディレクトリの既定設定を利用して任意の Bash または PowerShell コマンドをホストシステムにインポートし実行できる。", "risk": "攻撃者はホストシステム上で任意のシェルコマンドを実行できるようになる。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "認証されていないユーザーがファイルをインポートできる状態であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json" ], "evidenceIds": [ "E1" ] }, { "text": "Autorun ディレクトリが既定設定のままであること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cleo Multiple Products」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-55956", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956", "https://nvd.nist.gov/vuln/detail/CVE-2024-55956" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2024-55956」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-55956", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956", "https://nvd.nist.gov/vuln/detail/CVE-2024-55956" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-55956", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956", "https://nvd.nist.gov/vuln/detail/CVE-2024-55956" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-55956", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956", "https://nvd.nist.gov/vuln/detail/CVE-2024-55956" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-55956", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956", "https://nvd.nist.gov/vuln/detail/CVE-2024-55956" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-55956", "label": "CVE公式レコード" }, { "url": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending", "label": "CVE掲載の参考情報" }, { "url": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55956", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "sourceField": "retained:/originalText", "excerpt": "Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/55xxx/CVE-2024-55956.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "sourceField": "/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55956", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-55956\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-55956（Cleo Multiple Products）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていないユーザーがファイルをインポートできる状態であること。\n・Autorun ディレクトリが既定設定のままであること。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-55956", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:09:02.275Z", "lastSuccess": "2026-10-24T06:09:02.275Z", "sourceCheckedAt": "2026-10-24T06:09:02.275Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-20767", "aliases": [], "title": "ColdFusion：脆弱性情報", "summary": "ColdFusion 2023.6、2021.12 以前のバージョンに不適切なアクセス制御の脆弱性があり、任意のファイルシステム読み取りが可能になる。攻撃者はこの脆弱性を利用して制限されたファイルにアクセスまたは変更できる。悪用にはユーザー操作は不要で、管理パネルがインターネットに公開されている必要がある。", "risk": "制限されたファイルにアクセスまたは変更される可能性がある。", "product": "ColdFusion", "category": "other", "component": "package", "severity": "high", "cvss": 7.4, "cvssVersion": "3.1", "cvssSource": "adobe", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "affected": [ { "product": "ColdFusion", "range": "<= 2021.12" }, { "product": "ColdFusion", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止する。", "「CVE-2024-20767」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-20767", "label": "CVE公式レコード" }, { "url": "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20767", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-03-18T11:43:28.473Z", "modifiedAt": "2025-10-21T23:05:22.747Z", "fetchedAt": "2026-10-24T05:04:09.733Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.", "sourceTitle": "ColdFusion | Improper Access Control (CWE-284)", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "ColdFusion", "vendor": "Adobe", "versions": [ { "lessThanOrEqual": "2021.12", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-20767", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json", "fetchedAt": "2026-10-24T05:04:09.733Z", "publishedAt": "2024-03-18T11:43:28.473Z", "modifiedAt": "2025-10-21T23:05:22.747Z", "state": "published", "provider": "adobe", "title": "ColdFusion | Improper Access Control (CWE-284)", "descriptions": [ { "lang": "en", "value": "ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Adobe", "product": "ColdFusion", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2021.12", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-284", "lang": "en", "description": "Improper Access Control (CWE-284)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 7.4, "baseSeverity": "HIGH", "provider": "adobe", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html", "label": "CVE", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20767", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"ColdFusion\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2021.12\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-284\",\"description\":\"Improper Access Control (CWE-284)\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"availabilityRequirement\":\"NOT_DEFINED\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"environmentalScore\":7.4,\"environmentalSeverity\":\"HIGH\",\"exploitCodeMaturity\":\"NOT_DEFINED\",\"integrityImpact\":\"HIGH\",\"integrityRequirement\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"HIGH\",\"modifiedAttackVector\":\"NETWORK\",\"modifiedAvailabilityImpact\":\"NONE\",\"modifiedConfidentialityImpact\":\"HIGH\",\"modifiedIntegrityImpact\":\"HIGH\",\"modifiedPrivilegesRequired\":\"NONE\",\"modifiedScope\":\"UNCHANGED\",\"modifiedUserInteraction\":\"NONE\",\"privilegesRequired\":\"NONE\",\"remediationLevel\":\"NOT_DEFINED\",\"reportConfidence\":\"NOT_DEFINED\",\"scope\":\"UNCHANGED\",\"temporalScore\":7.4,\"temporalSeverity\":\"HIGH\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-20767:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "sourcePath": "retained:/originalText", "text": "Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-20767:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "modifiedAt": "2024-12-16T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:22.747Z", "fetchedAt": "2026-10-24T05:04:09.733Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-16T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "ColdFusionに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:04:09.733Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ece8aa29bcec7652102dfeff48919ed7a2ff79b620f93c366a820d3cff8fc3ab", "sourceModifiedAt": "2025-10-21T23:05:22.747Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "ColdFusion 2023.6、2021.12 以前のバージョンに不適切なアクセス制御の脆弱性があり、任意のファイルシステム読み取りが可能になる。攻撃者はこの脆弱性を利用して制限されたファイルにアクセスまたは変更できる。悪用にはユーザー操作は不要で、管理パネルがインターネットに公開されている必要がある。", "risk": "制限されたファイルにアクセスまたは変更される可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "ColdFusion 2023.6、2021.12 以前のバージョンが影響対象である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "管理パネルがインターネットに公開されていることが前提条件である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "悪用にはユーザーの操作は不要である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "構造化された影響情報 (S5) は 2021.12 以下のみを示すが、記述 (S2) では 2023.6 も含むため、情報に不一致がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "公式の対象表：Adobe / ColdFusion。影響ありとして記載：2021.12以下の版。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json" ], "evidenceIds": [ "E3" ] }, { "text": "「ColdFusion」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-20767", "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "https://nvd.nist.gov/vuln/detail/CVE-2024-20767" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2024-20767」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-20767", "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "https://nvd.nist.gov/vuln/detail/CVE-2024-20767" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-20767", "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "https://nvd.nist.gov/vuln/detail/CVE-2024-20767" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-20767", "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "https://nvd.nist.gov/vuln/detail/CVE-2024-20767" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-20767", "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "https://nvd.nist.gov/vuln/detail/CVE-2024-20767" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-20767", "label": "CVE公式レコード" }, { "url": "https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20767", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json", "sourceField": "/containers/cna/title", "excerpt": "ColdFusion | Improper Access Control (CWE-284)", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/20xxx/CVE-2024-20767.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"ColdFusion\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2021.12\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-20767\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-20767（ColdFusion）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ColdFusion 2023.6、2021.12 以前のバージョンが影響対象である。\n・管理パネルがインターネットに公開されていることが前提条件である。\n・悪用にはユーザーの操作は不要である。\n・構造化された影響情報 (S5) は 2021.12 以下のみを示すが、記述 (S2) では 2023.6 も含むため、情報に不一致がある。\n・公式の対象表：Adobe / ColdFusion。影響ありとして記載：2021.12以下の版。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-20767", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:04:09.733Z", "lastSuccess": "2026-10-24T05:04:09.733Z", "sourceCheckedAt": "2026-10-24T05:04:09.733Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-35250", "aliases": [], "title": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 21H2 / Windows 11 version 22H2 / Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows Server 2：権限の奪取", "summary": "Windows カーネルモードドライバーの特権昇格脆弱性", "risk": "ローカル攻撃者がこの脆弱性を利用して特権をエスカレートできる可能性がある。", "product": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 21H2 / Windows 11 version 22H2 / Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows Server 2", "category": "windows", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1507", "range": ">= 10.0.10240.0 / < 10.0.10240.20680（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.7070（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.5936（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.0 / < 10.0.17763.5936（環境: ARM64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19044.0 / < 10.0.19044.4529（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.4529（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 21H2", "range": ">= 10.0.22000.0 / < 10.0.22000.3019（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H2", "range": ">= 10.0.22621.0 / < 10.0.22621.3737（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.3737（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.3737（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1", "range": ">= 6.1.7601.0 / < 6.1.7601.27170（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "range": ">= 6.1.7601.0 / < 6.1.7601.27170（環境: x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.22720（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "range": ">= 6.0.6003.0 / < 6.0.6003.22720（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.24919（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.24919（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.22023（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.22023（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.7070（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.7070（環境: x64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.5936（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.5936（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.2527（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.950（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止する。", "「CVE-2024-35250」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-35250", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35250", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2024-06-11T16:59:47.128Z", "modifiedAt": "2026-08-10T15:12:06.600Z", "fetchedAt": "2026-10-24T05:04:12.868Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows Kernel-Mode Driver Elevation of Privilege Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.10240.0", "lessThan": "10.0.10240.20680", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7070", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5936", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.0", "lessThan": "10.0.17763.5936", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19044.0", "lessThan": "10.0.19044.4529", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.4529", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22000.0", "lessThan": "10.0.22000.3019", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22621.0", "lessThan": "10.0.22621.3737", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 23H2", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.3737", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.3737", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27170", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27170", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22720", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22720", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.24919", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.24919", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22023", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22023", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7070", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7070", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5936", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5936", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.2527", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.950", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-35250", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "fetchedAt": "2026-10-24T05:04:12.868Z", "publishedAt": "2024-06-11T16:59:47.128Z", "modifiedAt": "2026-08-10T15:12:06.600Z", "state": "published", "provider": "microsoft", "title": "Windows Kernel-Mode Driver Elevation of Privilege Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Windows Kernel-Mode Driver Elevation of Privilege Vulnerability", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.10240.0", "lessThan": "10.0.10240.20680", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7070", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5936", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/3", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.0", "lessThan": "10.0.17763.5936", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/4", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.19044.0", "lessThan": "10.0.19044.4529", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.4529", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "sourcePath": "/containers/cna/affected/6", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.22000.0", "lessThan": "10.0.22000.3019", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "sourcePath": "/containers/cna/affected/7", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.22621.0", "lessThan": "10.0.22621.3737", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 23H2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.3737", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/9", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.3737", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27170", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27170", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/12", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22720", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "sourcePath": "/containers/cna/affected/13", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22720", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/14", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.24919", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.24919", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22023", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22023", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7070", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7070", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5936", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/21", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/21/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5936", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/22", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/22/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.2527", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/23", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/23/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.950", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-822", "lang": "en-US", "description": "CWE-822: Untrusted Pointer Dereference", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250", "label": "Windows Kernel-Mode Driver Elevation of Privilege Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-35250", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20680\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7070\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5936\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.17763.5936\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.4529\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.4529\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22000.0\",\"lessThan\":\"10.0.22000.3019\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.3737\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 23H2\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.3737\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.3737\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27170\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27170\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22720\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22720\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24919\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24919\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22023\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22023\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7070\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7070\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5936\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/21", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5936\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/22", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2527\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/affected/23", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.950\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Windows Kernel-Mode Driver Elevation of Privilege Vulnerability", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-822: Untrusted Pointer Dereference\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-822\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-35250:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "sourcePath": "retained:/originalText", "text": "Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-35250:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "modifiedAt": "2024-12-16T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-10T15:12:06.600Z", "fetchedAt": "2026-10-24T05:04:12.868Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-16T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 21H2 / Windows 11 version 22H2 / Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows Server 2に権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:04:12.868Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "38af3d2f09217e6b998c9a5641651bbc618b8bb352d1969dda935dc38faccea2", "sourceModifiedAt": "2026-08-10T15:12:06.600Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows カーネルモードドライバーの特権昇格脆弱性", "risk": "ローカル攻撃者がこの脆弱性を利用して特権をエスカレートできる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "ローカル攻撃者が対象システムにアクセスできることが前提である。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "影響を受けるのは Windows カーネルモードドライバーが動作している環境である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20680未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7070未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.5936未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.0以上、10.0.17763.5936未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.4529未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.4529未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.22000.0以上、10.0.22000.3019未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.3737未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.3737未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.3737未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27170未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27170未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22720未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.22720未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.24919未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.24919未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22023未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22023未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7070未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7070未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E23" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.5936未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E24" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.5936未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E25" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2527未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E26" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.950未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E27" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250" ], "evidenceIds": [ "E29" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E4" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250" ], "evidenceIds": [ "E28" ] }, { "text": "「CVE-2024-35250」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-35250", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "https://nvd.nist.gov/vuln/detail/CVE-2024-35250" ] }, { "text": "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2024-35250", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "https://nvd.nist.gov/vuln/detail/CVE-2024-35250" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json" ], "evidenceIds": [ "E4" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-35250", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35250", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/title", "excerpt": "Windows Kernel-Mode Driver Elevation of Privilege Vulnerability", "language": null }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "sourceField": "retained:/originalText", "excerpt": "Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Windows Kernel-Mode Driver Elevation of Privilege Vulnerability", "language": "en-US", "representation": "source_excerpt" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20680\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7070\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5936\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.17763.5936\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.4529\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.4529\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22000.0\",\"lessThan\":\"10.0.22000.3019\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.3737\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 23H2\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.3737\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.3737\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27170\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27170\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22720\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22720\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24919\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24919\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22023\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22023\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7070\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7070\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5936\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/21", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5936\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E26", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/22", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2527\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E27", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/35xxx/CVE-2024-35250.json", "sourceField": "/containers/cna/affected/23", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.950\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E28", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E29", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-35250", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-35250\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-35250（Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 21H2 / Windows 11 version 22H2 / Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows Server 2）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ローカル攻撃者が対象システムにアクセスできることが前提である。\n・影響を受けるのは Windows カーネルモードドライバーが動作している環境である。\n・公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20680未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7070未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.5936未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.0以上、10.0.17763.5936未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.4529未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.4529未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.22000.0以上、10.0.22000.3019未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.3737未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.3737未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.3737未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27170未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27170未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22720未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.22720未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.24919未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.24919未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22023未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22023未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7070未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7070未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.5936未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.5936未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2527未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.950未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-35250", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:04:12.868Z", "lastSuccess": "2026-10-24T05:04:12.868Z", "sourceCheckedAt": "2026-10-24T05:04:12.868Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-50623", "aliases": [], "title": "n/a：コード実行", "summary": "Cleo Harmony、VLTrader、LexiCom の各製品で、バージョン 5.8.0.21 より前のものに、制限のないファイルのアップロードおよびダウンロードが可能で、リモートコード実行につながる可能性があります。", "risk": "攻撃者がリモートコード実行を行い、製品が動作しているサーバー上で権限の高いコードを実行できる可能性があります。", "product": "Cleo Multiple Products", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止してください。", "「CVE-2024-50623」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-50623", "label": "CVE公式レコード" }, { "url": "https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory", "label": "CVE掲載の参考情報" }, { "url": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50623", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-10-27T00:00:00.000Z", "modifiedAt": "2026-10-07T17:49:17.986Z", "fetchedAt": "2026-10-24T05:04:16.103Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-50623", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json", "fetchedAt": "2026-10-24T05:04:16.103Z", "publishedAt": "2024-10-27T00:00:00.000Z", "modifiedAt": "2026-10-07T17:49:17.986Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-434", "lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50623", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-434\",\"description\":\"CWE-434 Unrestricted Upload of File with Dangerous Type\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-50623:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "sourcePath": "retained:/originalText", "text": "Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-50623:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "modifiedAt": "2024-12-13T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-07T17:49:17.986Z", "fetchedAt": "2026-10-24T05:04:16.103Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-13T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:04:16.103Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "17e149fc23ab63f09cab39338821d50ee38ade260fdcaa484bc570e8d64321a1", "sourceModifiedAt": "2026-10-07T17:49:17.986Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cleo Harmony、VLTrader、LexiCom の各製品で、バージョン 5.8.0.21 より前のものに、制限のないファイルのアップロードおよびダウンロードが可能で、リモートコード実行につながる可能性があります。", "risk": "攻撃者がリモートコード実行を行い、製品が動作しているサーバー上で権限の高いコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cleo Multiple Products」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-50623", "https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update", "https://nvd.nist.gov/vuln/detail/CVE-2024-50623" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2024-50623」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-50623", "https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update", "https://nvd.nist.gov/vuln/detail/CVE-2024-50623" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-50623", "https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update", "https://nvd.nist.gov/vuln/detail/CVE-2024-50623" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-50623", "https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update", "https://nvd.nist.gov/vuln/detail/CVE-2024-50623" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-50623", "https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update", "https://nvd.nist.gov/vuln/detail/CVE-2024-50623" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-50623", "label": "CVE公式レコード" }, { "url": "https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory", "label": "CVE掲載の参考情報" }, { "url": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50623", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "sourceField": "retained:/originalText", "excerpt": "Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50623.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-50623\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-50623（Cleo Multiple Products）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-50623", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:04:16.103Z", "lastSuccess": "2026-10-24T05:04:16.103Z", "sourceCheckedAt": "2026-10-24T05:04:16.103Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2024-49138", "aliases": [], "title": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2：権限の奪取", "summary": "Windows Common Log File System ドライバーにヒープベースのバッファオーバーフローがあり、ローカルの攻撃者が特権を昇格させることができます。", "risk": "攻撃者はシステム上でより高い権限でコードを実行できるようになります。", "product": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2", "category": "windows", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1507", "range": ">= 10.0.10240.0 / < 10.0.10240.20857（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.7606（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.6659（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19043.0 / < 10.0.19044.5247（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.5247（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H2", "range": ">= 10.0.22621.0 / < 10.0.22621.4602（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H3", "range": ">= 10.0.22631.0 / < 10.0.22631.4602（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.4602（環境: x64-based Systems）" }, { "product": "Windows 11 Version 24H2", "range": ">= 10.0.26100.0 / < 10.0.26100.2605（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.23016（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1", "range": ">= 6.1.7601.0 / < 6.1.7601.27467（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "range": ">= 6.1.7601.0 / < 6.1.7601.27467（環境: x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.23016（環境: 32-bit Systems）" }, { "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "range": ">= 6.0.6003.0 / < 6.0.6003.23016（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.25222（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.25222（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.22318（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.22318（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.7606（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.7606（環境: x64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.6659（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.6659（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.2966（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.1308（環境: x64-based Systems）" }, { "product": "Windows Server 2025", "range": ">= 10.0.26100.0 / < 10.0.26100.2605（環境: x64-based Systems）" }, { "product": "Windows Server 2025 (Server Core installation)", "range": ">= 10.0.26100.0 / < 10.0.26100.2605（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2024-49138」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-49138", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49138", "label": "Windows Common Log File System Driver Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49138", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49138", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2024-12-10T17:49:48.419Z", "modifiedAt": "2026-06-09T18:30:58.123Z", "fetchedAt": "2026-10-24T05:04:34.752Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.10240.0", "lessThan": "10.0.10240.20857", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7606", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.6659", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19043.0", "lessThan": "10.0.19044.5247", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.5247", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22621.0", "lessThan": "10.0.22621.4602", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.4602", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.4602", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.2605", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.23016", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27467", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27467", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "32-bit Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.23016", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.23016", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25222", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25222", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22318", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22318", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7606", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7606", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.6659", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.6659", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.2966", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.1308", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.2605", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.2605", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-49138", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "fetchedAt": "2026-10-24T05:04:34.752Z", "publishedAt": "2024-12-10T17:49:48.419Z", "modifiedAt": "2026-06-09T18:30:58.123Z", "state": "published", "provider": "microsoft", "title": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.10240.0", "lessThan": "10.0.10240.20857", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7606", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.6659", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/3", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.19043.0", "lessThan": "10.0.19044.5247", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/4", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.5247", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.22621.0", "lessThan": "10.0.22621.4602", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "sourcePath": "/containers/cna/affected/6", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.4602", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/7", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.4602", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.2605", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/9", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.23016", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27467", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27467", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/12", "platforms": [ "32-bit Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.23016", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "sourcePath": "/containers/cna/affected/13", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.23016", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/14", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25222", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25222", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22318", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22318", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7606", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7606", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.6659", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/21", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/21/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.6659", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/22", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/22/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.2966", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/23", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/23/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.1308", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "sourcePath": "/containers/cna/affected/24", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/24/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.2605", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "sourcePath": "/containers/cna/affected/25", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/25/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.2605", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-122", "lang": "en-US", "description": "CWE-122: Heap-based Buffer Overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49138", "label": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-49138", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.exploit-db.com/exploits/52270", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://packetstorm.news/files/id/190585/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20857\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7606\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6659\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19044.5247\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.5247\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.4602\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.4602\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.4602\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.2605\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23016\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27467\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27467\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23016\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23016\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25222\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25222\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22318\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22318\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7606\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7606\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6659\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/21", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6659\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/22", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2966\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/23", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.1308\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/24", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.2605\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/25", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/affected/25", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.2605\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-122: Heap-based Buffer Overflow\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-122\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-49138:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "sourcePath": "retained:/originalText", "text": "Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-49138:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "modifiedAt": "2024-12-10T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-06-09T18:30:58.123Z", "fetchedAt": "2026-10-24T05:04:34.752Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-10T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2に権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:04:34.752Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ab334fabb329c0a517ee78e06841cc7b1fd8c5a6ca174b8e04584515afde5440", "sourceModifiedAt": "2026-06-09T18:30:58.123Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows Common Log File System ドライバーにヒープベースのバッファオーバーフローがあり、ローカルの攻撃者が特権を昇格させることができます。", "risk": "攻撃者はシステム上でより高い権限でコードを実行できるようになります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20857未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7606未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.6659未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19044.5247未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.5247未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.4602未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.4602未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.4602未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.2605未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.23016未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27467未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27467未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.23016未満。対象の環境：32-bit Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.23016未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25222未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25222未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22318未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22318未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7606未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7606未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.6659未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E23" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.6659未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E24" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2966未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E25" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.1308未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E26" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.2605未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E27" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.2605未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E28" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138" ], "evidenceIds": [ "E30" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138" ], "evidenceIds": [ "E29" ] }, { "text": "「CVE-2024-49138」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-49138", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49138", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49138", "https://nvd.nist.gov/vuln/detail/CVE-2024-49138" ] }, { "text": "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2024-49138", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49138", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49138", "https://nvd.nist.gov/vuln/detail/CVE-2024-49138" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-49138", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49138", "label": "Windows Common Log File System Driver Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49138", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49138", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "sourceField": "retained:/originalText", "excerpt": "Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.", "language": "en", "representation": "retained_feed_field" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/title", "excerpt": "Windows Common Log File System Driver Elevation of Privilege Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20857\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7606\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6659\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19044.5247\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.5247\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.4602\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.4602\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.4602\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.2605\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23016\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27467\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27467\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23016\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.23016\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25222\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25222\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22318\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22318\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7606\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7606\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6659\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/21", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6659\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/22", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2966\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E26", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/23", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.1308\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E27", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/24", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.2605\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E28", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/49xxx/CVE-2024-49138.json", "sourceField": "/containers/cna/affected/25", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.2605\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E29", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E30", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-49138", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-49138\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-49138（Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows Server 2）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20857未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7606未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.6659未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19044.5247未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.5247未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.4602未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.4602未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.4602未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.2605未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.23016未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27467未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27467未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.23016未満。対象の環境：32-bit Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.23016未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25222未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25222未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22318未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22318未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7606未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7606未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.6659未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.6659未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2966未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.1308未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.2605未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.2605未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-49138", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:04:34.752Z", "lastSuccess": "2026-10-24T05:04:34.752Z", "sourceCheckedAt": "2026-10-24T05:04:34.752Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-51378", "aliases": [], "title": "n/a：コード実行", "summary": "CyberPanel の dns/views.py と ftp/views.py にある getresetstatus が、POST 用の secMiddleware をバイパスし、statusfile プロパティにシェルメタ文字を入れることで、リモートの攻撃者が /dns/getresetstatus または /ftp/getresetstatus にアクセスして認証を回避し、任意のコマンドを実行できるようになります。", "risk": "認証が回避され、攻撃者がサーバー上で任意のコマンドを実行できる可能性があります。", "product": "CyberPersons CyberPanel", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N", "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "「CVE-2024-51378」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-51378", "label": "CVE公式レコード" }, { "url": "https://cwe.mitre.org/data/definitions/78.html", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683", "label": "CVE掲載の参考情報" }, { "url": "https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/", "label": "CVE掲載の参考情報" }, { "url": "https://cyberpanel.net/KnowledgeBase/home/change-logs/", "label": "CISAが示す関連情報" }, { "url": "https://cwe.mitre.org/data/definitions/420.html", "label": "CVE掲載の参考情報" }, { "url": "https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel", "label": "CVE掲載の参考情報" }, { "url": "https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51378", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-10-29T00:00:00.000Z", "modifiedAt": "2026-08-05T03:55:57.046Z", "fetchedAt": "2026-10-24T06:09:23.180Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-51378", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json", "fetchedAt": "2026-10-24T06:09:23.180Z", "publishedAt": "2024-10-29T00:00:00.000Z", "modifiedAt": "2026-08-05T03:55:57.046Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://cwe.mitre.org/data/definitions/78.html", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/2" }, { "url": "https://cyberpanel.net/KnowledgeBase/home/change-logs/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/3" }, { "url": "https://cwe.mitre.org/data/definitions/420.html", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/4" }, { "url": "https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/5" }, { "url": "https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/6" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51378", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"text\",\"lang\":\"en\",\"description\":\"n/a\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-51378:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "sourcePath": "retained:/originalText", "text": "CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-51378:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "modifiedAt": "2024-12-04T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-05T03:55:57.046Z", "fetchedAt": "2026-10-24T06:09:23.180Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-04T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:09:23.180Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a1d44e0df7c50884dccc08b64be3fa5452a0ad8f83555892feeeab36e0cedbd6", "sourceModifiedAt": "2026-08-05T03:55:57.046Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "CyberPanel の dns/views.py と ftp/views.py にある getresetstatus が、POST 用の secMiddleware をバイパスし、statusfile プロパティにシェルメタ文字を入れることで、リモートの攻撃者が /dns/getresetstatus または /ftp/getresetstatus にアクセスして認証を回避し、任意のコマンドを実行できるようになります。", "risk": "認証が回避され、攻撃者がサーバー上で任意のコマンドを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "リモートの攻撃者が HTTP GET リクエストで /dns/getresetstatus または /ftp/getresetstatus エンドポイントにアクセスできること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json" ], "evidenceIds": [ "E1" ] }, { "text": "secMiddleware が POST リクエストにのみ適用されるため、GET リクエストで認証チェックがバイパスできること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json" ], "evidenceIds": [ "E1" ] }, { "text": "statusfile パラメータにシェルメタ文字（例: ;, && など）を含めて送信できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json" ], "evidenceIds": [ "E3" ] }, { "text": "「CyberPersons CyberPanel」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-51378", "https://cwe.mitre.org/data/definitions/78.html", "https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683", "https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/", "https://cyberpanel.net/KnowledgeBase/home/change-logs/", "https://cwe.mitre.org/data/definitions/420.html", "https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel", "https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "https://nvd.nist.gov/vuln/detail/CVE-2024-51378" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2024-51378」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-51378", "https://cwe.mitre.org/data/definitions/78.html", "https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683", "https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/", "https://cyberpanel.net/KnowledgeBase/home/change-logs/", "https://cwe.mitre.org/data/definitions/420.html", "https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel", "https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "https://nvd.nist.gov/vuln/detail/CVE-2024-51378" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-51378", "https://cwe.mitre.org/data/definitions/78.html", "https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683", "https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/", "https://cyberpanel.net/KnowledgeBase/home/change-logs/", "https://cwe.mitre.org/data/definitions/420.html", "https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel", "https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "https://nvd.nist.gov/vuln/detail/CVE-2024-51378" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-51378", "https://cwe.mitre.org/data/definitions/78.html", "https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683", "https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/", "https://cyberpanel.net/KnowledgeBase/home/change-logs/", "https://cwe.mitre.org/data/definitions/420.html", "https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel", "https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "https://nvd.nist.gov/vuln/detail/CVE-2024-51378" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-51378", "https://cwe.mitre.org/data/definitions/78.html", "https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683", "https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/", "https://cyberpanel.net/KnowledgeBase/home/change-logs/", "https://cwe.mitre.org/data/definitions/420.html", "https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel", "https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "https://nvd.nist.gov/vuln/detail/CVE-2024-51378" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-51378", "label": "CVE公式レコード" }, { "url": "https://cwe.mitre.org/data/definitions/78.html", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683", "label": "CVE掲載の参考情報" }, { "url": "https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/", "label": "CVE掲載の参考情報" }, { "url": "https://cyberpanel.net/KnowledgeBase/home/change-logs/", "label": "CISAが示す関連情報" }, { "url": "https://cwe.mitre.org/data/definitions/420.html", "label": "CVE掲載の参考情報" }, { "url": "https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel", "label": "CVE掲載の参考情報" }, { "url": "https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51378", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "sourceField": "retained:/originalText", "excerpt": "CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51378.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-51378", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-51378\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-51378（CyberPersons CyberPanel）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの攻撃者が HTTP GET リクエストで /dns/getresetstatus または /ftp/getresetstatus エンドポイントにアクセスできること。\n・secMiddleware が POST リクエストにのみ適用されるため、GET リクエストで認証チェックがバイパスできること。\n・statusfile パラメータにシェルメタ文字（例: ;, && など）を含めて送信できること。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-51378", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:09:23.180Z", "lastSuccess": "2026-10-24T06:09:23.180Z", "sourceCheckedAt": "2026-10-24T06:09:23.180Z", "errorCode": null }, "glossary": [ { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" } ] } }, { "id": "CVE-2023-45727", "aliases": [], "title": "Proself Enterprise/Standard Edition / Proself Gateway Edition / Proself Mail Sanitize Edition：脆弱性情報", "summary": "Proself Enterprise/Standard Edition Ver5.62 以前、Proself Gateway Edition Ver1.65 以前、Proself Mail Sanitize Edition Ver1.08 以前の製品では、リモートの認証されていない攻撃者が細工された XML データを含むリクエストを送ることで、XML External Entity (XXE) 攻撃を実行でき、サーバ上の任意のファイル（例: アカウント情報が含まれるファイル）を読み取られる可能性があります。", "risk": "細工されたリクエストに含まれる不正な XML データを処理させることで、サーバ上のアカウント情報を含む任意のファイルが窃取される可能性があります。", "product": "Proself Enterprise/Standard Edition / Proself Gateway Edition / Proself Mail Sanitize Edition", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "jpcert", "cvssVector": null, "affected": [ { "product": "Proself Enterprise/Standard Edition", "range": "Ver5.62 and earlier" }, { "product": "Proself Gateway Edition", "range": "Ver1.65 and earlier" }, { "product": "Proself Mail Sanitize Edition", "range": "Ver1.08 and earlier" } ], "fixed": [], "steps": [ "開発者が提供する情報に基づき、最新版へアップデートしてください。", "アップデート版が入手できるまでの間、開発者が提供する暫定的なワークアラウンドを実施して本脆弱性の影響を回避してください。", "次のバージョンではサポートが終了しておりアップデートが提供されないため、利用を停止するか Ver.5 以降の後継製品への乗り換えを検討してください。", "「CVE-2023-45727」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://jvn.jp/jp/JVN95981460/", "label": "CVE：jpcert" }, { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "label": "CVE：jpcert" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-45727", "label": "CVE公式レコード" }, { "url": "https://www.proself.jp/information/153/", "label": "CISAが示す関連情報" }, { "url": "https://jvn.jp/en/jp/JVN95981460/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45727", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-10-18T09:01:12.285Z", "modifiedAt": "2025-10-21T23:05:34.245Z", "fetchedAt": "2026-10-24T05:04:37.980Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "North Grid Corporation", "product": "Proself Enterprise/Standard Edition", "versions": [ { "version": "Ver5.62 and earlier", "status": "affected" } ] }, { "vendor": "North Grid Corporation", "product": "Proself Gateway Edition", "versions": [ { "version": "Ver1.65 and earlier", "status": "affected" } ] }, { "vendor": "North Grid Corporation", "product": "Proself Mail Sanitize Edition", "versions": [ { "version": "Ver1.08 and earlier", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-45727", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "fetchedAt": "2026-10-24T05:04:37.980Z", "publishedAt": "2023-10-18T09:01:12.285Z", "modifiedAt": "2025-10-21T23:05:34.245Z", "state": "published", "provider": "jpcert", "title": "", "descriptions": [ { "lang": "en", "value": "Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "North Grid Corporation", "product": "Proself Enterprise/Standard Edition", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "Ver5.62 and earlier", "status": "affected" } ] }, { "vendor": "North Grid Corporation", "product": "Proself Gateway Edition", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "Ver1.65 and earlier", "status": "affected" } ] }, { "vendor": "North Grid Corporation", "product": "Proself Mail Sanitize Edition", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "Ver1.08 and earlier", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "XML external entities (XXE)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.proself.jp/information/153/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://jvn.jp/en/jp/JVN95981460/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-45727", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"North Grid Corporation\",\"product\":\"Proself Enterprise/Standard Edition\",\"versions\":[{\"version\":\"Ver5.62 and earlier\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"North Grid Corporation\",\"product\":\"Proself Gateway Edition\",\"versions\":[{\"version\":\"Ver1.65 and earlier\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"North Grid Corporation\",\"product\":\"Proself Mail Sanitize Edition\",\"versions\":[{\"version\":\"Ver1.08 and earlier\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"XML external entities (XXE)\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-45727:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "sourcePath": "retained:/originalText", "text": "North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-45727:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "linked:JVN95981460:section:概要", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "sourcePath": "section:概要", "text": "株式会社ノースグリッドが提供する Proself には、XML 外部実体参照 (XXE) に関する脆弱性が存在します。", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2023-45727", "relatedJvn": "JVN95981460" }, { "evidenceId": "linked:JVN95981460:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "sourcePath": "section:影響を受けるシステム", "text": "Proself Enterprise/Standard Edition Ver5.62 およびそれ以前\n\nProself Gateway Edition Ver1.65 およびそれ以前\n\nProself Mail Sanitize Edition Ver1.08 およびそれ以前", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2023-45727", "relatedJvn": "JVN95981460" }, { "evidenceId": "linked:JVN95981460:section:詳細情報", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "sourcePath": "section:詳細情報", "text": "株式会社ノースグリッドが提供するオンラインストレージサーバ Proself には、XML 外部実体参照 (XXE) に関する脆弱性 ( CWE-611 ) が存在します。\n\n開発者によると、本脆弱性を悪用した攻撃が既に確認されています。", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2023-45727", "relatedJvn": "JVN95981460" }, { "evidenceId": "linked:JVN95981460:section:想定される影響", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "sourcePath": "section:想定される影響", "text": "細工されたリクエストに含まれる不正な XML データを当該製品が処理することで、サーバ上のアカウント情報を含む任意のファイルを窃取される可能性があります。", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2023-45727", "relatedJvn": "JVN95981460" }, { "evidenceId": "linked:JVN95981460:section:対策方法", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "sourcePath": "section:対策方法", "text": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n\nワークアラウンドを実施する\n\nアップデート版を適用するまでの間、暫定対応を実施することで、本脆弱性の影響を回避することができます。詳細は 開発者が提供する情報 を確認してください。\n\n現行製品の利用を停止し、後続製品に乗り換える\n\n次のバージョンではサポートが終了しており、アップデートはリリースされないため、利用を停止するか Ver.5 以降の後継製品への乗り換えを検討してください。\n\nProself Enterprise/Standard Edition Ver.4 およびそれ以前", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2023-45727", "relatedJvn": "JVN95981460" }, { "evidenceId": "linked:JVN95981460:section:ベンダ情報", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "sourcePath": "section:ベンダ情報", "text": "ベンダ\n\nリンク\n\n株式会社ノースグリッド\n\n[至急]Proselfのゼロデイ脆弱性(CVE-2023-45727)による攻撃発生について(更新)", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2023-45727", "relatedJvn": "JVN95981460" } ], "limits": { "completeness": "official_record_with_linked_advisories", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。 CVEが直接参照しているJVN記事の日本語本文を、記事中のCVE番号を照合して追加しています。", "excludedJvnSources": [] }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "modifiedAt": "2024-12-03T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true }, { "sourceType": "JVN", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "id": "JVN95981460", "modifiedAt": "2023-10-17T15:00:00.000Z" } ], "relatedDocuments": [ { "type": "jvn", "id": "JVN95981460", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "modifiedAt": "2023-10-17T15:00:00.000Z", "affectedStatements": [ { "lang": "ja", "value": "Proself Enterprise/Standard Edition Ver5.62 およびそれ以前\n\nProself Gateway Edition Ver1.65 およびそれ以前\n\nProself Mail Sanitize Edition Ver1.08 およびそれ以前", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n\nワークアラウンドを実施する\n\nアップデート版を適用するまでの間、暫定対応を実施することで、本脆弱性の影響を回避することができます。詳細は 開発者が提供する情報 を確認してください。\n\n現行製品の利用を停止し、後続製品に乗り換える\n\n次のバージョンではサポートが終了しており、アップデートはリリースされないため、利用を停止するか Ver.5 以降の後継製品への乗り換えを検討してください。\n\nProself Enterprise/Standard Edition Ver.4 およびそれ以前", "sourcePath": "section:対策方法" } ] } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:34.245Z", "fetchedAt": "2026-10-24T05:04:37.980Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-03T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Proself Enterprise/Standard Edition / Proself Gateway Edition / Proself Mail Sanitize Editionに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:04:37.980Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c4b330ae8d1e7887e0a2b6eb09ecbc9cb34147eb16169041a3476bff0b66445f", "sourceModifiedAt": "2025-10-21T23:05:34.245Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Proself Enterprise/Standard Edition Ver5.62 以前、Proself Gateway Edition Ver1.65 以前、Proself Mail Sanitize Edition Ver1.08 以前の製品では、リモートの認証されていない攻撃者が細工された XML データを含むリクエストを送ることで、XML External Entity (XXE) 攻撃を実行でき、サーバ上の任意のファイル（例: アカウント情報が含まれるファイル）を読み取られる可能性があります。", "risk": "細工されたリクエストに含まれる不正な XML データを処理させることで、サーバ上のアカウント情報を含む任意のファイルが窃取される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "攻撃者はリモートから認証なしで、XML データが不正に構成されたリクエストを送信できる必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "https://jvn.jp/jp/JVN95981460/" ], "evidenceIds": [ "E1", "E4" ] }, { "text": "公式の対象表：North Grid Corporation / Proself Enterprise/Standard Edition。影響ありとして記載：Ver5.62 and earlier。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：North Grid Corporation / Proself Gateway Edition。影響ありとして記載：Ver1.65 and earlier。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：North Grid Corporation / Proself Mail Sanitize Edition。影響ありとして記載：Ver1.08 and earlier。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727" ], "evidenceIds": [ "E9" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json" ], "evidenceIds": [ "E5" ] }, { "text": "「Proself Enterprise/Standard Edition / Proself Gateway Edition / Proself Mail Sanitize Edition」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-45727", "https://www.proself.jp/information/153/", "https://jvn.jp/en/jp/JVN95981460/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "https://nvd.nist.gov/vuln/detail/CVE-2023-45727" ] } ], "actions": [ { "text": "開発者が提供する情報に基づき、最新版へアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://jvn.jp/jp/JVN95981460/" ], "evidenceIds": [ "E8" ] }, { "text": "アップデート版が入手できるまでの間、開発者が提供する暫定的なワークアラウンドを実施して本脆弱性の影響を回避してください。", "kind": "fix", "sourceUrls": [ "https://jvn.jp/jp/JVN95981460/" ], "evidenceIds": [ "E8" ] }, { "text": "次のバージョンではサポートが終了しておりアップデートが提供されないため、利用を停止するか Ver.5 以降の後継製品への乗り換えを検討してください。", "kind": "fix", "sourceUrls": [ "https://jvn.jp/jp/JVN95981460/" ], "evidenceIds": [ "E8" ] }, { "text": "「CVE-2023-45727」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-45727", "https://www.proself.jp/information/153/", "https://jvn.jp/en/jp/JVN95981460/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "https://nvd.nist.gov/vuln/detail/CVE-2023-45727" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-45727", "https://www.proself.jp/information/153/", "https://jvn.jp/en/jp/JVN95981460/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "https://nvd.nist.gov/vuln/detail/CVE-2023-45727" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-45727", "https://www.proself.jp/information/153/", "https://jvn.jp/en/jp/JVN95981460/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "https://nvd.nist.gov/vuln/detail/CVE-2023-45727" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json" ], "evidenceIds": [ "E5" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-45727", "https://www.proself.jp/information/153/", "https://jvn.jp/en/jp/JVN95981460/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "https://nvd.nist.gov/vuln/detail/CVE-2023-45727" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://jvn.jp/jp/JVN95981460/", "label": "CVE：jpcert" }, { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "label": "CVE：jpcert" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-45727", "label": "CVE公式レコード" }, { "url": "https://www.proself.jp/information/153/", "label": "CISAが示す関連情報" }, { "url": "https://jvn.jp/en/jp/JVN95981460/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45727", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "sourceField": "section:概要", "excerpt": "株式会社ノースグリッドが提供する Proself には、XML 外部実体参照 (XXE) に関する脆弱性が存在します。", "language": null, "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "sourceField": "section:想定される影響", "excerpt": "細工されたリクエストに含まれる不正な XML データを当該製品が処理することで、サーバ上のアカウント情報を含む任意のファイルを窃取される可能性があります。", "language": null, "representation": "source_excerpt" }, { "id": "E4", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "sourceField": "section:詳細情報", "excerpt": "株式会社ノースグリッドが提供するオンラインストレージサーバ Proself には、XML 外部実体参照 (XXE) に関する脆弱性 ( CWE-611 ) が存在します。\n\n開発者によると、本脆弱性を悪用した攻撃が既に確認されています。", "language": null, "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"North Grid Corporation\",\"product\":\"Proself Enterprise/Standard Edition\",\"versions\":[{\"version\":\"Ver5.62 and earlier\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"North Grid Corporation\",\"product\":\"Proself Gateway Edition\",\"versions\":[{\"version\":\"Ver1.65 and earlier\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/45xxx/CVE-2023-45727.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"North Grid Corporation\",\"product\":\"Proself Mail Sanitize Edition\",\"versions\":[{\"version\":\"Ver1.08 and earlier\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://jvn.jp/jp/JVN95981460/", "sourceField": "section:対策方法", "excerpt": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n\nワークアラウンドを実施する\n\nアップデート版を適用するまでの間、暫定対応を実施することで、本脆弱性の影響を回避することができます。詳細は 開発者が提供する情報 を確認してください。\n\n現行製品の利用を停止し、後続製品に乗り換える\n\n次のバージョンではサポートが終了しており、アップデートはリリースされないため、利用を停止するか Ver.5 以降の後継製品への乗り換えを検討してください。\n\nProself Enterprise/Standard Edition Ver.4 およびそれ以前", "language": null, "representation": "source_excerpt" }, { "id": "E9", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-45727", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-45727\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-45727（Proself Enterprise/Standard Edition / Proself Gateway Edition / Proself Mail Sanitize Edition）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者はリモートから認証なしで、XML データが不正に構成されたリクエストを送信できる必要があります。\n・公式の対象表：North Grid Corporation / Proself Enterprise/Standard Edition。影響ありとして記載：Ver5.62 and earlier。\n・公式の対象表：North Grid Corporation / Proself Gateway Edition。影響ありとして記載：Ver1.65 and earlier。\n・公式の対象表：North Grid Corporation / Proself Mail Sanitize Edition。影響ありとして記載：Ver1.08 and earlier。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-45727", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:04:37.980Z", "lastSuccess": "2026-10-24T05:04:37.980Z", "sourceCheckedAt": "2026-10-24T05:04:37.980Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-11667", "aliases": [], "title": "ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) series firmware / USG20(W)-VPN series firmware：ファイルへの不正アクセス", "summary": "Zyxel の ATP 系列、USG FLEX 系列、USG FLEX 50(W) 系列、USG20(W)-VPN 系列のファームウェア（該当バージョン）における Web 管理インターフェースにディレクトリトラバーサルの脆弱性があり、細工した URL を用いることでファイルのダウンロードやアップロードが可能になる。", "risk": "攻撃者はこの脆弱性を利用して、対象デバイス上の任意のファイルを取得したり、任意のファイルをアップロードしたりできる可能性がある。", "product": "ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) series firmware / USG20(W)-VPN series firmware", "category": "other", "component": "package", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "Zyxel", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "ATP series firmware", "range": "versions V5.00 through V5.38" }, { "product": "USG FLEX series firmware", "range": "versions V5.00 through V5.38" }, { "product": "USG FLEX 50(W) series firmware", "range": "versions V5.10 through V5.38" }, { "product": "USG20(W)-VPN series firmware", "range": "versions V5.10 through V5.38" } ], "fixed": [], "steps": [ "ベンダーの指示に従った緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "「CVE-2024-11667」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11667", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024", "label": "CVE掲載の参考情報" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11667", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-11-27T09:39:41.691Z", "modifiedAt": "2026-08-05T03:55:55.854Z", "fetchedAt": "2026-10-24T05:04:51.493Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "ATP series firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "versions V5.00 through V5.38" } ] }, { "defaultStatus": "unaffected", "product": "USG FLEX series firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "versions V5.00 through V5.38" } ] }, { "defaultStatus": "unaffected", "product": "USG FLEX 50(W) series firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "versions V5.10 through V5.38" } ] }, { "defaultStatus": "unaffected", "product": "USG20(W)-VPN series firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "versions V5.10 through V5.38" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-11667", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "fetchedAt": "2026-10-24T05:04:51.493Z", "publishedAt": "2024-11-27T09:39:41.691Z", "modifiedAt": "2026-08-05T03:55:55.854Z", "state": "published", "provider": "Zyxel", "title": "", "descriptions": [ { "lang": "en", "value": "A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Zyxel", "product": "ATP series firmware", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "versions V5.00 through V5.38", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG FLEX series firmware", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "versions V5.00 through V5.38", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG FLEX 50(W) series firmware", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "versions V5.10 through V5.38", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG20(W)-VPN series firmware", "sourcePath": "/containers/cna/affected/3", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "versions V5.10 through V5.38", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "Zyxel", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024", "label": "Zyxel", "tags": [ "vendor-advisory" ], "provider": "Zyxel", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"ATP series firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"versions V5.00 through V5.38\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"USG FLEX series firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"versions V5.00 through V5.38\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"USG FLEX 50(W) series firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"versions V5.10 through V5.38\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"USG20(W)-VPN series firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"versions V5.10 through V5.38\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-22\",\"description\":\"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-11667:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "sourcePath": "retained:/originalText", "text": "Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-11667:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "modifiedAt": "2024-12-03T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-05T03:55:55.854Z", "fetchedAt": "2026-10-24T05:04:51.493Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-03T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) series firmware / USG20(W)-VPN series firmwareにファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:04:51.493Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "fd5c7fdd9b12c1a30ec8f171bdc41c4c7ed3076a2e1a0e5a5f7ef0d75c80dfe8", "sourceModifiedAt": "2026-08-05T03:55:55.854Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zyxel の ATP 系列、USG FLEX 系列、USG FLEX 50(W) 系列、USG20(W)-VPN 系列のファームウェア（該当バージョン）における Web 管理インターフェースにディレクトリトラバーサルの脆弱性があり、細工した URL を用いることでファイルのダウンロードやアップロードが可能になる。", "risk": "攻撃者はこの脆弱性を利用して、対象デバイス上の任意のファイルを取得したり、任意のファイルをアップロードしたりできる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "攻撃者が Web 管理インターフェースに対して細工した URL を送信できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json" ], "evidenceIds": [ "E1" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json" ], "evidenceIds": [ "E3" ] }, { "text": "「ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) series firmware / USG20(W)-VPN series firmware」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-11667", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024", "https://nvd.nist.gov/vuln/detail/CVE-2024-11667" ] } ], "actions": [ { "text": "ベンダーの指示に従った緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2024-11667」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-11667", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024", "https://nvd.nist.gov/vuln/detail/CVE-2024-11667" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-11667", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024", "https://nvd.nist.gov/vuln/detail/CVE-2024-11667" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-11667", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024", "https://nvd.nist.gov/vuln/detail/CVE-2024-11667" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-11667", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024", "https://nvd.nist.gov/vuln/detail/CVE-2024-11667" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11667", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024", "label": "CVE掲載の参考情報" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11667", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "sourceField": "retained:/originalText", "excerpt": "Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11667.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"ATP series firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"versions V5.00 through V5.38\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "sourceField": "/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-11667\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-11667（ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) series firmware / USG20(W)-VPN series firmware）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者が Web 管理インターフェースに対して細工した URL を送信できること。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-11667", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:04:51.493Z", "lastSuccess": "2026-10-24T05:04:51.493Z", "sourceCheckedAt": "2026-10-24T05:04:51.493Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-11680", "aliases": [], "title": "ProjectSend：脆弱性情報", "summary": "ProjectSend のバージョン r1720 未満は、認証が不適切な脆弱性により、リモートの認証されていない攻撃者が options.php に細工した HTTP リクエストを送るだけで、アプリケーションの設定を不正に変更できる。", "risk": "この脆弱性が悪用されると、攻撃者はアカウントを作成したり、ウェブシェルをアップロードしたり、悪意のある JavaScript を埋め込んだりできる。", "product": "ProjectSend", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "VulnCheck", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "ProjectSend", "range": "< r1720" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "「CVE-2024-11680」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json", "label": "CVE：VulnCheck" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11680", "label": "CVE公式レコード" }, { "url": "https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744", "label": "CISAが示す関連情報" }, { "url": "https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml", "label": "CVE掲載の参考情報" }, { "url": "https://vulncheck.com/advisories/projectsend-bypass", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11680", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-11-26T09:55:23.588Z", "modifiedAt": "2026-07-14T22:54:33.035Z", "fetchedAt": "2026-10-24T05:04:54.892Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.", "sourceTitle": "ProjectSend Unauthenticated Configuration Modification", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "packageURL": "pkg:github/projectsend/projectsend", "product": "ProjectSend", "programFiles": [ "options.php" ], "repo": "https://github.com/projectsend/projectsend", "vendor": "ProjectSend", "versions": [ { "lessThan": "r1720", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-11680", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json", "fetchedAt": "2026-10-24T05:04:54.892Z", "publishedAt": "2024-11-26T09:55:23.588Z", "modifiedAt": "2026-07-14T22:54:33.035Z", "state": "published", "provider": "VulnCheck", "title": "ProjectSend Unauthenticated Configuration Modification", "descriptions": [ { "lang": "en", "value": "ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "ProjectSend", "product": "ProjectSend", "sourcePath": "/containers/cna/affected/0", "packageURL": "pkg:github/projectsend/projectsend", "repo": "https://github.com/projectsend/projectsend", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [ "options.php" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "r1720", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-306", "lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "VulnCheck", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744", "label": "VulnCheck", "tags": [ "patch" ], "provider": "VulnCheck", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf", "label": "VulnCheck", "tags": [ "third-party-advisory", "exploit" ], "provider": "VulnCheck", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb", "label": "VulnCheck", "tags": [ "exploit" ], "provider": "VulnCheck", "sourcePath": "/containers/cna/references/2" }, { "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml", "label": "VulnCheck", "tags": [ "exploit" ], "provider": "VulnCheck", "sourcePath": "/containers/cna/references/3" }, { "url": "https://vulncheck.com/advisories/projectsend-bypass", "label": "VulnCheck", "tags": [ "third-party-advisory" ], "provider": "VulnCheck", "sourcePath": "/containers/cna/references/4" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"packageURL\":\"pkg:github/projectsend/projectsend\",\"product\":\"ProjectSend\",\"programFiles\":[\"options.php\"],\"repo\":\"https://github.com/projectsend/projectsend\",\"vendor\":\"ProjectSend\",\"versions\":[{\"lessThan\":\"r1720\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-306\",\"description\":\"CWE-306 Missing Authentication for Critical Function\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-11680:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "sourcePath": "retained:/originalText", "text": "ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-11680:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "modifiedAt": "2024-12-03T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-14T22:54:33.035Z", "fetchedAt": "2026-10-24T05:04:54.892Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-12-03T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "ProjectSendに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:04:54.892Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a49f2d488eaaf96e7e02b0e2a6dadc3cb74d13608050b9299939076909c9f775", "sourceModifiedAt": "2026-07-14T22:54:33.035Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "ProjectSend のバージョン r1720 未満は、認証が不適切な脆弱性により、リモートの認証されていない攻撃者が options.php に細工した HTTP リクエストを送るだけで、アプリケーションの設定を不正に変更できる。", "risk": "この脆弱性が悪用されると、攻撃者はアカウントを作成したり、ウェブシェルをアップロードしたり、悪意のある JavaScript を埋め込んだりできる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は ProjectSend のバージョンが r1720 未満であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者はリモートから認証されていない状態であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者は options.php へ細工した HTTP リクエストを送信できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：ProjectSend / ProjectSend。影響ありとして記載：r1720未満の版。対象のファイル：options.php", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json" ], "evidenceIds": [ "E3" ] }, { "text": "「ProjectSend」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-11680", "https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744", "https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf", "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb", "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml", "https://vulncheck.com/advisories/projectsend-bypass", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "https://nvd.nist.gov/vuln/detail/CVE-2024-11680" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2024-11680」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-11680", "https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744", "https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf", "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb", "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml", "https://vulncheck.com/advisories/projectsend-bypass", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "https://nvd.nist.gov/vuln/detail/CVE-2024-11680" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-11680", "https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744", "https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf", "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb", "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml", "https://vulncheck.com/advisories/projectsend-bypass", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "https://nvd.nist.gov/vuln/detail/CVE-2024-11680" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-11680", "https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744", "https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf", "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb", "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml", "https://vulncheck.com/advisories/projectsend-bypass", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "https://nvd.nist.gov/vuln/detail/CVE-2024-11680" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-11680", "https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744", "https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf", "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb", "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml", "https://vulncheck.com/advisories/projectsend-bypass", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "https://nvd.nist.gov/vuln/detail/CVE-2024-11680" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json", "label": "CVE：VulnCheck" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11680", "label": "CVE公式レコード" }, { "url": "https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744", "label": "CISAが示す関連情報" }, { "url": "https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml", "label": "CVE掲載の参考情報" }, { "url": "https://vulncheck.com/advisories/projectsend-bypass", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11680", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json", "sourceField": "/containers/cna/title", "excerpt": "ProjectSend Unauthenticated Configuration Modification", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11680.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"packageURL\":\"pkg:github/projectsend/projectsend\",\"product\":\"ProjectSend\",\"programFiles\":[\"options.php\"],\"repo\":\"https://github.com/projectsend/projectsend\",\"vendor\":\"ProjectSend\",\"versions\":[{\"lessThan\":\"r1720\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11680", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-11680\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-11680（ProjectSend）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は ProjectSend のバージョンが r1720 未満であること。\n・攻撃者はリモートから認証されていない状態であること。\n・攻撃者は options.php へ細工した HTTP リクエストを送信できること。\n・公式の対象表：ProjectSend / ProjectSend。影響ありとして記載：r1720未満の版。対象のファイル：options.php\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-11680", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:04:54.892Z", "lastSuccess": "2026-10-24T05:04:54.892Z", "sourceCheckedAt": "2026-10-24T05:04:54.892Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-28461", "aliases": [], "title": "n/a：コード実行", "summary": "Array Networks の Array AG シリーズおよび vxAG（バージョン 9.4.0.481 以前）では、認証なしで HTTP ヘッダーの flags 属性を利用して SSL VPN ゲートウェイのファイルシステムを閲覧でき、脆弱な URL を通じてリモートコード実行が可能です。", "risk": "攻撃者は SSL VPN ゲートウェイ上のローカルファイルを読み取り、コードを実行させることができます。", "product": "Array Networks AG/vxAG ArrayOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-28461", "label": "CVE公式レコード" }, { "url": "https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28461", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-03-15T00:00:00.000Z", "modifiedAt": "2026-08-05T03:55:54.358Z", "fetchedAt": "2026-10-24T06:10:54.300Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated \"a new Array AG release with the fix will be available soon.\"", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-28461", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json", "fetchedAt": "2026-10-24T06:10:54.300Z", "publishedAt": "2023-03-15T00:00:00.000Z", "modifiedAt": "2026-08-05T03:55:54.358Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated \"a new Array AG release with the fix will be available soon.\"", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28461", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated \"a new Array AG release with the fix will be available soon.\"", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"text\",\"lang\":\"en\",\"description\":\"n/a\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-28461:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "sourcePath": "retained:/originalText", "text": "Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-28461:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "modifiedAt": "2024-11-25T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-05T03:55:54.358Z", "fetchedAt": "2026-10-24T06:10:54.300Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-11-25T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:10:54.300Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8589792d43723b722912d6d772bc5cab00bdbb0b976da4fce6e86e68b76fd645", "sourceModifiedAt": "2026-08-05T03:55:54.358Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Array Networks の Array AG シリーズおよび vxAG（バージョン 9.4.0.481 以前）では、認証なしで HTTP ヘッダーの flags 属性を利用して SSL VPN ゲートウェイのファイルシステムを閲覧でき、脆弱な URL を通じてリモートコード実行が可能です。", "risk": "攻撃者は SSL VPN ゲートウェイ上のローカルファイルを読み取り、コードを実行させることができます。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象は Array Networks の Array AG シリーズおよび vxAG の SSL VPN ゲートウェイで、バージョン 9.4.0.481 以前が該当します。攻撃者は認証なしで HTTP ヘッダーに flags 属性を付与したリクエストを送信できる必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Array Networks AG/vxAG ArrayOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-28461", "https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "https://nvd.nist.gov/vuln/detail/CVE-2023-28461" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461" ], "evidenceIds": [ "E4" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-28461", "https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "https://nvd.nist.gov/vuln/detail/CVE-2023-28461" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-28461", "label": "CVE公式レコード" }, { "url": "https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28461", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated \"a new Array AG release with the fix will be available soon.\"", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "sourceField": "retained:/originalText", "excerpt": "Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28461.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-28461\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-28461（Array Networks AG/vxAG ArrayOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Array Networks の Array AG シリーズおよび vxAG の SSL VPN ゲートウェイで、バージョン 9.4.0.481 以前が該当します。攻撃者は認証なしで HTTP ヘッダーに flags 属性を付与したリクエストを送信できる必要があります。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-28461", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:10:54.300Z", "lastSuccess": "2026-10-24T06:10:54.300Z", "sourceCheckedAt": "2026-10-24T06:10:54.300Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2024-8929", "aliases": [ "GHSA-h35g-vwh6-m678" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1.*（8.1.31 未満）、8.2.*（8.2.26 未満）、8.3.*（8.3.14 未満）のバージョンでは、攻撃的な MySQL サーバーがクライアントに対してヒープの一部内容を漏洩させ、他の SQL リクエストのデータや同一サーバー上の別ユーザーのデータが開示される可能性があります。", "risk": "攻撃者が操作した MySQL サーバーからの応答を通じて、PHP のヒープに残っている他のリクエストの結果や別ユーザーのデータが漏洩する恐れがあります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 5.8, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.31（機能: mysqlnd）" }, { "product": "PHP", "range": "8.2.* / < 8.2.24（機能: mysqlnd）" }, { "product": "PHP", "range": "8.3.* / < 8.3.14（機能: mysqlnd）" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。（機能: mysqlnd）" } ], "fixed": [ "8.1.31", "8.2.26", "8.3.14" ], "steps": [ "PHP を 8.1.31、8.2.26、8.3.14 にアップデートすることで修正されます。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8929", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-11-21T18:15:38.000Z", "modifiedAt": "2025-11-03T22:33:10.858Z", "fetchedAt": "2026-10-24T05:05:01.596Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.", "sourceTitle": "Leak partial content of the heap through heap buffer over-read in mysqlnd", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "modules": [ "mysqlnd" ], "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.31", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.24", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.14", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: mysqlnd。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-8929", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "fetchedAt": "2026-10-24T05:05:01.596Z", "publishedAt": "2024-11-22T06:15:29.643Z", "modifiedAt": "2025-11-03T22:33:10.858Z", "state": "published", "provider": "php", "title": "Leak partial content of the heap through heap buffer over-read in mysqlnd", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\n\nBy connecting to a fake MySQL server or tampering with network packets and initiating a SQL Query, it is possible to abuse the function static enum_func_status php_mysqlnd_rset_field_read when parsing MySQL fields packets in order to include the rest of the heap content starting from the address of the cursor of the currently read buffer.\n\nUsing PHP-FPM which stays alive between request, and between two different SQL query requests, as the previous buffer used to store received data from MySQL is not emptied and malloc allocates a memory region which is very near the previous one, one is able to extract the response content of the previous MySQL request from the PHP-FPM worker.\n\n### Details\n\nAfter the connection against a MySQL database is established, when initiating a SQL query, for example through mysqli_query , the expected response from the server is of the following format :\n\nA column count packet, describing the number of fields that are expected to be received;\n\nAs much as fields packets as there are fields to be transmitted;\n\nAn intermediate EOF packet, telling it is the end of the \"fields packets\";\n\nAs much as row packet as there are entries to be transmitted.\n\nThe MySQL fields packets, are parsed by the static enum_func_status php_mysqlnd_rset_field_read defined in /ext/mysqlnd/mysqlnd_wireprotocol.c .\n\nHere are the interesting parts :\n\nWe can read in the second code block that COM_FIELD_LIST is not supported anymore. However, after the packet is parsed, the third code block tries to parse a def fields which is supposed to define the default values. However, it is used for COM_FIELD_LIST requests, as per the MySQL documentation .\n\nUsing a specifically crafted packet, we can enter the last code block, by :\n\nAdjusting the size of the packet header to read the malicious data;\n\nAdding a length field at the end which is not equal to MYSQLND_NULL_LENGTH\n\nAdding a byte, so that macro BAIL_IF_NO_MORE_DATA , which verifies if ((p - begin) > packet->header.size)) doesn't redirect the control flow.\n\nIn this code block:\n\nlen now contains our arbitrary length value;\n\nBAIL_IF_NO_MORE_DATA is then called, however p , the cursor on the buffer, has not been modified for now and the macro is not called anymore until the end of the function;\n\nA memory area of size len + 1 is allocated and the address is assigned to meta->def , which is returned to the end user;\n\nmeta->def is filled up with len bytes, read from p .\n\nHowever, p points to a buffer that is (p - pfc->cmd_buffer.buffer) bytes length, and pfc->cmd_buffer.buffer points to a memory area of 4096 bytes. As len can be decoded as a uint_32t , its value can be much more higher, allowing to over-read pfc->cmd_buffer.buffer .\n\nThis result in adding to the MySQL server response the remaining data contains in the buffer, and the data on the heap up to len - (4096 - (p - pfc->cmd_buffer.buffer))) .\n\nAs the buffer used to store the MySQL response is not emptied after each request after being deallocated, and memory allocation with the libc function malloc almost everytime allocate a chunk located very close from the previous allocated memory area, one is able to retrieve content from earlier SQL queries by taking advantage of PHP-FPM workers, which continues running between requests and hold onto some contextual data.\n\nDuring our tests, we were able to extract the content of previous SQL Query response from the memory of the PHP-FPM Worker.\n\n### Other problems\n\nThis is unfortunately the only place where such over-read is possible. After thorough investigation, following places have been found with a similar problem:\n\nRESP packet upsert filename\n\nOK packet message\n\nRESP packet for stmt row data\n\nps_fetch_from_1_to_8_bytes\n\nps_fetch_float\n\nps_fetch_double\n\nps_fetch_time\n\nps_fetch_date\n\nps_fetch_datetime\n\nps_fetch_string\n\nps_fetch_bit\n\nRESP packet for query row data (just possible overflow on 32bit)\n\n### Impact\n\nIn order to exploit this vulnerability, one needs to be able to control the address of the MySQL target or execute its own script using the context on an existing PHP-FPM worker pool.\n\nThe heap content, starting from some bytes after the beginning of the buffer used to stores MySQL response can be extracted and send back to the user that initiates a SQL Query.\n\nFor example, during our tests, we were able to extract the content of the previous SQL query response.\n\n#### Example scenario\n\nYou're a hosting provider and you offer a bunch of services like managed databases and VPS's (not uncommon).\n\nAs a hosting provider, you may want to offer tools to your users to manage databases, something like phpmyadmin (or alike) (not uncommon). As a user, you have the choice of setting up a database yourself on a VPS hosted by that hosting provider. You could setup a malicious database server. Many different people may use the database management software, but that software connects to many different database servers; including the malicious one you set up. Your malicious database server can now trick that database management software (that different users use) to leak data of other users.", "sourcePath": "html:.markdown-body.comment-body", "representation": "defensive_sections", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [ "mysqlnd" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.24", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.14", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.31; patched versions: 8.1.31", "sourcePath": "html:Patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.26; patched versions: 8.2.26", "sourcePath": "html:Patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.14; patched versions: 8.3.14", "sourcePath": "html:Patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20250110-0008/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"modules\":[\"mysqlnd\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.31\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.24\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.14\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-200\",\"description\":\"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-125\",\"description\":\"CWE-125 Out-of-bounds Read\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"LOW\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-h35g-vwh6-m678:html:.markdown-body.comment-body", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "sourcePath": "html:.markdown-body.comment-body", "text": "### Summary\n\nBy connecting to a fake MySQL server or tampering with network packets and initiating a SQL Query, it is possible to abuse the function static enum_func_status php_mysqlnd_rset_field_read when parsing MySQL fields packets in order to include the rest of the heap content starting from the address of the cursor of the currently read buffer.\n\nUsing PHP-FPM which stays alive between request, and between two different SQL query requests, as the previous buffer used to store received data from MySQL is not emptied and malloc allocates a memory region which is very near the previous one, one is able to extract the response content of the previous MySQL request from the PHP-FPM worker.\n\n### Details\n\nAfter the connection against a MySQL database is established, when initiating a SQL query, for example through mysqli_query , the expected response from the server is of the following format :\n\nA column count packet, describing the number of fields that are expected to be received;\n\nAs much as fields packets as there are fields to be transmitted;\n\nAn intermediate EOF packet, telling it is the end of the \"fields packets\";\n\nAs much as row packet as there are entries to be transmitted.\n\nThe MySQL fields packets, are parsed by the static enum_func_status php_mysqlnd_rset_field_read defined in /ext/mysqlnd/mysqlnd_wireprotocol.c .\n\nHere are the interesting parts :\n\nWe can read in the second code block that COM_FIELD_LIST is not supported anymore. However, after the packet is parsed, the third code block tries to parse a def fields which is supposed to define the default values. However, it is used for COM_FIELD_LIST requests, as per the MySQL documentation .\n\nUsing a specifically crafted packet, we can enter the last code block, by :\n\nAdjusting the size of the packet header to read the malicious data;\n\nAdding a length field at the end which is not equal to MYSQLND_NULL_LENGTH\n\nAdding a byte, so that macro BAIL_IF_NO_MORE_DATA , which verifies if ((p - begin) > packet->header.size)) doesn't redirect the control flow.\n\nIn this code block:\n\nlen now contains our arbitrary length value;\n\nBAIL_IF_NO_MORE_DATA is then called, however p , the cursor on the buffer, has not been modified for now and the macro is not called anymore until the end of the function;\n\nA memory area of size len + 1 is allocated and the address is assigned to meta->def , which is returned to the end user;\n\nmeta->def is filled up with len bytes, read from p .\n\nHowever, p points to a buffer that is (p - pfc->cmd_buffer.buffer) bytes length, and pfc->cmd_buffer.buffer points to a memory area of 4096 bytes. As len can be decoded as a uint_32t , its value can be much more higher, allowing to over-read pfc->cmd_buffer.buffer .\n\nThis result in adding to the MySQL server response the remaining data contains in the buffer, and the data on the heap up to len - (4096 - (p - pfc->cmd_buffer.buffer))) .\n\nAs the buffer used to store the MySQL response is not emptied after each request after being deallocated, and memory allocation with the libc function malloc almost everytime allocate a chunk located very close from the previous allocated memory area, one is able to retrieve content from earlier SQL queries by taking advantage of PHP-FPM workers, which continues running between requests and hold onto some contextual data.\n\nDuring our tests, we were able to extract the content of previous SQL Query response from the memory of the PHP-FPM Worker.\n\n### Other problems\n\nThis is unfortunately the only place where such over-read is possible. After thorough investigation, following places have been found with a similar problem:\n\nRESP packet upsert filename\n\nOK packet message\n\nRESP packet for stmt row data\n\nps_fetch_from_1_to_8_bytes\n\nps_fetch_float\n\nps_fetch_double\n\nps_fetch_time\n\nps_fetch_date\n\nps_fetch_datetime\n\nps_fetch_string\n\nps_fetch_bit\n\nRESP packet for query row data (just possible overflow on 32bit)\n\n### Impact\n\nIn order to exploit this vulnerability, one needs to be able to control the address of the MySQL target or execute its own script using the context on an existing PHP-FPM worker pool.\n\nThe heap content, starting from some bytes after the beginning of the buffer used to stores MySQL response can be extracted and send back to the user that initiates a SQL Query.\n\nFor example, during our tests, we were able to extract the content of the previous SQL query response.\n\n#### Example scenario\n\nYou're a hosting provider and you offer a bunch of services like managed databases and VPS's (not uncommon).\n\nAs a hosting provider, you may want to offer tools to your users to manage databases, something like phpmyadmin (or alike) (not uncommon). As a user, you have the choice of setting up a database yourself on a VPS hosted by that hosting provider. You could setup a malicious database server. Many different people may use the database management software, but that software connects to many different database servers; including the malicious one you set up. Your malicious database server can now trick that database management software (that different users use) to leak data of other users.", "truncated": false, "representation": "defensive_html_sections", "filtered": true }, { "evidenceId": "php:GHSA-h35g-vwh6-m678:html:Package-Affected_versions-Patched_versions", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "sourcePath": "html:Package-Affected_versions-Patched_versions", "text": "{\"package\":{\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.1.31\",\"patched_versions\":\"8.1.31\"}", "truncated": false, "representation": "normalized_html_fields" }, { "evidenceId": "php:GHSA-h35g-vwh6-m678:html:Package-Affected_versions-Patched_versions", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "sourcePath": "html:Package-Affected_versions-Patched_versions", "text": "{\"package\":{\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.2.26\",\"patched_versions\":\"8.2.26\"}", "truncated": false, "representation": "normalized_html_fields" }, { "evidenceId": "php:GHSA-h35g-vwh6-m678:html:Package-Affected_versions-Patched_versions", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "sourcePath": "html:Package-Affected_versions-Patched_versions", "text": "{\"package\":{\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.3.14\",\"patched_versions\":\"8.3.14\"}", "truncated": false, "representation": "normalized_html_fields" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T22:33:10.858Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "modifiedAt": null, "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。 APIの取得制限時に、同じ開発元の公開HTMLから本文・対象版・修正版を取得しています。HTMLで特定できない更新日時は未確認のままです。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T22:33:10.858Z", "fetchedAt": "2026-10-24T05:05:01.596Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2024-11-21T18:15:38.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:05:01.596Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c88d7fa0f42ba5f274e8a24cc669be96cace6c2dcc8830b7681476e3c72fd8a9", "sourceModifiedAt": "2025-11-03T22:33:10.858Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.31 未満）、8.2.*（8.2.26 未満）、8.3.*（8.3.14 未満）のバージョンでは、攻撃的な MySQL サーバーがクライアントに対してヒープの一部内容を漏洩させ、他の SQL リクエストのデータや同一サーバー上の別ユーザーのデータが開示される可能性があります。", "risk": "攻撃者が操作した MySQL サーバーからの応答を通じて、PHP のヒープに残っている他のリクエストの結果や別ユーザーのデータが漏洩する恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.1 系列でバージョン 8.1.31 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.2 系列でバージョン 8.2.24 未満が影響を受けますが、別の情報源では 8.2.26 未満とされています。構造化された情報 (S5) とパッケージ情報 (S8) に矛盾があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678" ], "evidenceIds": [ "E3", "E4", "E2" ] }, { "text": "PHP 8.3 系列でバージョン 8.3.14 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者が MySQL サーバーを操作できる、または偽の MySQL サーバーに接続できることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678" ], "evidenceIds": [ "E1", "E5", "E2" ] }, { "text": "PHP-FPM のワーカーがリクエスト間でプロセスを保持し、メモリが再利用される環境であること。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "SQL クエリを実行する際に、攻撃者が MySQL フィールドパケットを細工できること。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.31未満。影響ありとして記載：8.2系のうち、8.2.24未満。影響ありとして記載：8.3系のうち、8.3.14未満。対象の機能：mysqlnd。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.31、8.2.26、8.3.14 にアップデートすることで修正されます。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678" ], "evidenceIds": [ "E6" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-8929", "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8929", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "sourceField": "/containers/cna/title", "excerpt": "Leak partial content of the heap through heap buffer over-read in mysqlnd", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8929.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"modules\":[\"mysqlnd\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.31\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.24\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.14\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "sourceField": "html:Package-Affected_versions-Patched_versions", "excerpt": "{\"package\":{\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.2.26\",\"patched_versions\":\"8.2.26\"}", "language": null, "representation": "normalized_html_fields" }, { "id": "E5", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "sourceField": "html:.markdown-body.comment-body", "excerpt": "### Summary\n\nBy connecting to a fake MySQL server or tampering with network packets and initiating a SQL Query, it is possible to abuse the function static enum_func_status php_mysqlnd_rset_field_read when parsing MySQL fields packets in order to include the rest of the heap content starting from the address of the cursor of the currently read buffer.\n\nUsing PHP-FPM which stays alive between request, and between two different SQL query requests, as the previous buffer used to store received data from MySQL is not emptied and malloc allocates a memory region which is very near the previous one, one is able to extract the response content of the previous MySQL request from the PHP-FPM worker.\n\n### Details\n\nAfter the connection against a MySQL database is established, when initiating a SQL query, for example through mysqli_query , the expected response from the server is of the following format :\n\nA column count packet, describing the number of fields that are expected to be received;\n\nAs much as fields packets as there are fields to be transmitted;\n\nAn intermediate EOF packet, telling it is the end of the \"fields packets\";\n\nAs much as row packet as there are entries to be transmitted.\n\nThe MySQL fields packets, are parsed by the static enum_func_status php_mysqlnd_rset_field_read defined in /ext/mysqlnd/mysqlnd_wireprotocol.c .\n\nHere are the interesting parts :\n\nWe can read in the second code block that COM_FIELD_LIST is not supported anymore. However, after the packet is parsed, the third code block tries to parse a def fields which is supposed to define the default values. However, it is used for COM_FIELD_LIST requests, as per the MySQL documentation .\n\nUsing a specifically crafted packet, we can enter the last code block, by :\n\nAdjusting the size of the packet header to read the malicious data;\n\nAdding a length field at the end which is not equal to MYSQLND_NULL_LENGTH\n\nAdding a byte, so that macro BAIL_IF_NO_MORE_DATA , which verifies if ((p - begin) > packet->header.size)) doesn't redirect the control flow.\n\nIn this code block:\n\nlen now contains our arbitrary length value;\n\nBAIL_IF_NO_MORE_DATA is then called, however p , the cursor on the buffer, has not been modified for now and the macro is not called anymore until the end of the function;\n\nA memory area of size len + 1 is allocated and the address is assigned to meta->def , which is returned to the end user;\n\nmeta->def is filled up with len bytes, read from p .\n\nHowever, p points to a buffer that is (p - pfc->cmd_buffer.buffer) bytes length, and pfc->cmd_buffer.buffer points to a memory area of 4096 bytes. As len can be decoded as a uint_32t , its value can be much more higher, allowing to over-read pfc->cmd_buffer.buffer .\n\nThis result in adding to the MySQL server response the remaining data contains in the buffer, and the data on the heap up to len - (4096 - (p - pfc->cmd_buffer.buffer))) .\n\nAs the buffer used to store the MySQL response is not emptied after each request after being deallocated, and memory allocation with the libc function malloc almost everytime allocate a chunk located very close from the previous allocated memory area, one is able to retrieve content from earlier SQL queries by taking advantage of PHP-FPM workers, which continues running between requests and hold onto some contextual data.\n\nDuring our tests, we were able to extract the content of previous SQL Query response from the memory of the PHP-FPM Worker.\n\n### Other problems\n\nThis is unfortunately the only place where such over-read is possible. After thorough investigation, following places have been found with a similar problem:\n\nRESP packet upsert filename\n\nOK packet message\n\nRESP packet for stmt row data\n\nps_fetch_from_1_to_8_bytes\n\nps_fetch_float\n\nps_fetch_double\n\nps_fetch_time\n\nps_fetch_date\n\nps_fetch_datetime\n\nps_fetch_string\n\nps_fetch_bit\n\nRESP packet for query row data (just possible overflow on 32bit)\n\n### Impact\n\nIn order to exploit this vulnerability, one needs to be able to control the address of the MySQL target or execute its own script using the context on an existing PHP-FPM worker pool.\n\nThe heap content, starting from some bytes after the beginning of the buffer used to stores MySQL response can be extracted and send back to the user that initiates a SQL Query.\n\nFor example, during our tests, we were able to extract the content of the previous SQL query response.\n\n#### Example scenario\n\nYou're a hosting provider and you offer a bunch of services like managed databases and VPS's (not uncommon).\n\nAs a hosting provider, you may want to offer tools to your users to manage databases, something like phpmyadmin (or alike) (not uncommon). As a user, you have the choice of setting up a database yourself on a VPS hosted by that hosting provider. You could setup a malicious database server. Many different people may use the database management software, but that software connects to many different database servers; including the malicious one you set up. Your malicious database server can now trick that database management software (that different users use) to leak data of other users.", "language": "en", "representation": "defensive_html_sections", "filtered": true }, { "id": "E6", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678", "sourceField": "/fixed", "excerpt": "[\"8.1.31\",\"8.2.26\",\"8.3.14\"]", "language": null } ], "supportRequest": "件名：CVE-2024-8929（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1 系列でバージョン 8.1.31 未満が影響を受けます。\n・PHP 8.2 系列でバージョン 8.2.24 未満が影響を受けますが、別の情報源では 8.2.26 未満とされています。構造化された情報 (S5) とパッケージ情報 (S8) に矛盾があります。\n・PHP 8.3 系列でバージョン 8.3.14 未満が影響を受けます。\n・攻撃者が MySQL サーバーを操作できる、または偽の MySQL サーバーに接続できることが前提です。\n・PHP-FPM のワーカーがリクエスト間でプロセスを保持し、メモリが再利用される環境であること。\n・SQL クエリを実行する際に、攻撃者が MySQL フィールドパケットを細工できること。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.31未満。影響ありとして記載：8.2系のうち、8.2.24未満。影響ありとして記載：8.3系のうち、8.3.14未満。対象の機能：mysqlnd。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-8929", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:05:01.596Z", "lastSuccess": "2026-10-24T05:05:01.596Z", "sourceCheckedAt": "2026-10-24T05:05:01.596Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2024-8932", "aliases": [ "GHSA-g665-fm4p-vhff" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1.*（8.1.31 未満）、8.2.*（8.2.26 未満）、8.3.*（8.3.14 未満）の 32 ビット環境において、ldap_escape() 関数に長い文字列を入力すると整数オーバーフローが発生し、範囲外書き込みが起こります。", "risk": "整数オーバーフローにより範囲外書き込みが発生し、メモリ破壊や予期しない動作を引き起こす可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.31（環境: 32 bit、機能: ldap）" }, { "product": "PHP", "range": "8.2.* / < 8.2.26（環境: 32 bit、機能: ldap）" }, { "product": "PHP", "range": "8.3.* / < 8.3.14（環境: 32 bit、機能: ldap）" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。（環境: 32 bit、機能: ldap）" } ], "fixed": [ "8.1.31", "8.2.26", "8.3.14" ], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8932", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-11-21T18:15:31.000Z", "modifiedAt": "2025-11-03T22:33:12.327Z", "fetchedAt": "2026-10-24T05:05:02.366Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.", "sourceTitle": "OOB access in ldap_escape", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "modules": [ "ldap" ], "platforms": [ "32 bit" ], "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.31", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.26", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.14", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: 32 bit / ldap。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-8932", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json", "fetchedAt": "2026-10-24T05:05:02.366Z", "publishedAt": "2024-11-22T06:03:29.764Z", "modifiedAt": "2025-11-03T22:33:12.327Z", "state": "published", "provider": "php", "title": "OOB access in ldap_escape", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Impact\n\nUncontrolled long string inputs to ldap_escape on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.\n\n### Details\n\nThis issue affected HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0.\n\nReference: https://nvd.nist.gov/vuln/detail/CVE-2020-1916\n\nPatch: facebook/hhvm@ abe0b29", "sourcePath": "html:.markdown-body.comment-body", "representation": "defensive_sections", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [ "32 bit" ], "modules": [ "ldap" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.14", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.31; patched versions: 8.1.31", "sourcePath": "html:Patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.26; patched versions: 8.2.26", "sourcePath": "html:Patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.14; patched versions: 8.3.14", "sourcePath": "html:Patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20250110-0009/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"modules\":[\"ldap\"],\"platforms\":[\"32 bit\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.31\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.26\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.14\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-787\",\"description\":\"CWE-787 Out-of-bounds Write\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-g665-fm4p-vhff:html:.markdown-body.comment-body", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff", "sourcePath": "html:.markdown-body.comment-body", "text": "### Impact\n\nUncontrolled long string inputs to ldap_escape on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.\n\n### Details\n\nThis issue affected HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0.\n\nReference: https://nvd.nist.gov/vuln/detail/CVE-2020-1916\n\nPatch: facebook/hhvm@ abe0b29", "truncated": false, "representation": "defensive_html_sections", "filtered": true }, { "evidenceId": "php:GHSA-g665-fm4p-vhff:html:Package-Affected_versions-Patched_versions", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff", "sourcePath": "html:Package-Affected_versions-Patched_versions", "text": "{\"package\":{\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.1.31\",\"patched_versions\":\"8.1.31\"}", "truncated": false, "representation": "normalized_html_fields" }, { "evidenceId": "php:GHSA-g665-fm4p-vhff:html:Package-Affected_versions-Patched_versions", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff", "sourcePath": "html:Package-Affected_versions-Patched_versions", "text": "{\"package\":{\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.2.26\",\"patched_versions\":\"8.2.26\"}", "truncated": false, "representation": "normalized_html_fields" }, { "evidenceId": "php:GHSA-g665-fm4p-vhff:html:Package-Affected_versions-Patched_versions", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff", "sourcePath": "html:Package-Affected_versions-Patched_versions", "text": "{\"package\":{\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.3.14\",\"patched_versions\":\"8.3.14\"}", "truncated": false, "representation": "normalized_html_fields" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T22:33:12.327Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff", "modifiedAt": null, "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。 APIの取得制限時に、同じ開発元の公開HTMLから本文・対象版・修正版を取得しています。HTMLで特定できない更新日時は未確認のままです。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T22:33:12.327Z", "fetchedAt": "2026-10-24T05:05:02.366Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2024-11-21T18:15:31.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:05:02.366Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "23dfb341dbab511ec521413f767f2804f25711a361628049a51ac3ab84476a32", "sourceModifiedAt": "2025-11-03T22:33:12.327Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.31 未満）、8.2.*（8.2.26 未満）、8.3.*（8.3.14 未満）の 32 ビット環境において、ldap_escape() 関数に長い文字列を入力すると整数オーバーフローが発生し、範囲外書き込みが起こります。", "risk": "整数オーバーフローにより範囲外書き込みが発生し、メモリ破壊や予期しない動作を引き起こす可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "32 ビットシステム上で、ldap_escape() 関数に長い文字列を入力できる環境。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.31未満。影響ありとして記載：8.2系のうち、8.2.26未満。影響ありとして記載：8.3系のうち、8.3.14未満。対象の環境：32 bit。対象の機能：ldap。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-8932", "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8932", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json", "sourceField": "/containers/cna/title", "excerpt": "OOB access in ldap_escape", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8932.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"modules\":[\"ldap\"],\"platforms\":[\"32 bit\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.31\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.26\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.14\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2024-8932（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・32 ビットシステム上で、ldap_escape() 関数に長い文字列を入力できる環境。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.31未満。影響ありとして記載：8.2系のうち、8.2.26未満。影響ありとして記載：8.3系のうち、8.3.14未満。対象の環境：32 bit。対象の機能：ldap。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-8932", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:05:02.366Z", "lastSuccess": "2026-10-24T05:05:02.366Z", "sourceCheckedAt": "2026-10-24T05:05:02.366Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-11234", "aliases": [ "GHSA-c5f2-jwm7-mmq2" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1 系列（8.1.31 未満）、8.2 系列（8.2.26 未満）、8.3 系列（8.3.14 未満）で、ストリームを使用しプロキシを設定し request_fulluri オプションを有効にすると、URI が適切にサニタイズされず、HTTP リクエストスミュージングが可能となり、攻撃者がサーバーから任意の HTTP リクエストを実行でき、外部ユーザーが通常アクセスできないリソースに到達できる可能性があります。", "risk": "攻撃者はサーバー上で任意の HTTP リクエストを送信でき、内部エンドポイントや外部からは見えないリソースにアクセスできるようになる恐れがあります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 4.8, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.31" }, { "product": "PHP", "range": "8.2.* / < 8.2.26" }, { "product": "PHP", "range": "8.3.* / < 8.3.14" } ], "fixed": [ "8.1.31", "8.2.26", "8.3.14" ], "steps": [ "PHP 8.1.31、8.2.26、8.3.14 以降のバージョンにアップデートして修正を適用する。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11234", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-11-21T18:15:25.000Z", "modifiedAt": "2025-11-03T21:51:51.580Z", "fetchedAt": "2026-10-24T05:05:09.307Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \"request_fulluri\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.", "sourceTitle": "Configuring a proxy in a stream context might allow for CRLF injection in URIs", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.31", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.26", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.14", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-11234", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "fetchedAt": "2026-10-24T05:05:09.307Z", "publishedAt": "2024-11-24T00:57:39.349Z", "modifiedAt": "2025-11-03T21:51:51.580Z", "state": "published", "provider": "php", "title": "Configuring a proxy in a stream context might allow for CRLF injection in URIs", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \"request_fulluri\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\n\nConfiguring a proxy in a stream context might allow for CRLF injection in URIs, resulting in HTTP request smuggling attacks.\n\n### Details\n\nWhen creating a stream using one of the available stream creation functions (e.g., fopen , file , file_get_contents ...), developers can specify a custom stream context containing a set of parameters to use during the connection. One such parameter, in the case of HTTP and FTP streams, is proxy . The HTTP context options also include a request_fulluri boolean, which is required by some proxies to correctly forward the request.\n\nWhile a normal request to http://example.com/path/to/file?query would results in the following HTTP request:\n\nwhen setting request_fulluri to true we obtain:\n\nThe vulnerability lies in the implementation of request_fulluri , which just inserts the raw URI into the HTTP request line. In particular, this bypasses the normal control characters sanitization usually performed when parsing the URL .\n\nThis means that, if the resource URI is under the partial control of an attacker, when the request_fulluri context parameter is true, a malicious actor could inject CRLF characters to perform a HTTP request smuggling attack.\n\nFurthermore, if a non-HTTP stream sets a proxy parameter in the context (right now only the FTP context supports this), the request_fulluri parameter gets automatically silently enabled without the developer ever knowing.\n\nNotice that, in the case of HTTP streams, setting a proxy is not strictly necessary, as the real issue is the request_fulluri parameter.\n\n### Impact\n\nCLRF injection in the URI leads to Server Side Request Forgery attacks (SSRF), which allows an attacker to bypass security controls, access internal endpoints, and, since we control the Host: header, potentially access different hosts or machines.\n\nCrafted requests can use any HTTP method and set any header to any value, including sensitive headers like Authorization , Cookie , Origin , or Referer .\n\nMoreover, in some setups, the attacker might be able to read the HTTP response of each of the smuggled request.", "sourcePath": "html:.markdown-body.comment-body", "representation": "defensive_sections", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.14", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.31; patched versions: 8.1.31", "sourcePath": "html:Patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.26; patched versions: 8.2.26", "sourcePath": "html:Patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.14; patched versions: 8.3.14", "sourcePath": "html:Patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20241220-0008/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.31\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.26\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.14\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \"request_fulluri\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-20\",\"description\":\"CWE-20 Improper Input Validation\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-c5f2-jwm7-mmq2:html:.markdown-body.comment-body", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "sourcePath": "html:.markdown-body.comment-body", "text": "### Summary\n\nConfiguring a proxy in a stream context might allow for CRLF injection in URIs, resulting in HTTP request smuggling attacks.\n\n### Details\n\nWhen creating a stream using one of the available stream creation functions (e.g., fopen , file , file_get_contents ...), developers can specify a custom stream context containing a set of parameters to use during the connection. One such parameter, in the case of HTTP and FTP streams, is proxy . The HTTP context options also include a request_fulluri boolean, which is required by some proxies to correctly forward the request.\n\nWhile a normal request to http://example.com/path/to/file?query would results in the following HTTP request:\n\nwhen setting request_fulluri to true we obtain:\n\nThe vulnerability lies in the implementation of request_fulluri , which just inserts the raw URI into the HTTP request line. In particular, this bypasses the normal control characters sanitization usually performed when parsing the URL .\n\nThis means that, if the resource URI is under the partial control of an attacker, when the request_fulluri context parameter is true, a malicious actor could inject CRLF characters to perform a HTTP request smuggling attack.\n\nFurthermore, if a non-HTTP stream sets a proxy parameter in the context (right now only the FTP context supports this), the request_fulluri parameter gets automatically silently enabled without the developer ever knowing.\n\nNotice that, in the case of HTTP streams, setting a proxy is not strictly necessary, as the real issue is the request_fulluri parameter.\n\n### Impact\n\nCLRF injection in the URI leads to Server Side Request Forgery attacks (SSRF), which allows an attacker to bypass security controls, access internal endpoints, and, since we control the Host: header, potentially access different hosts or machines.\n\nCrafted requests can use any HTTP method and set any header to any value, including sensitive headers like Authorization , Cookie , Origin , or Referer .\n\nMoreover, in some setups, the attacker might be able to read the HTTP response of each of the smuggled request.", "truncated": false, "representation": "defensive_html_sections", "filtered": true }, { "evidenceId": "php:GHSA-c5f2-jwm7-mmq2:html:Package-Affected_versions-Patched_versions", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "sourcePath": "html:Package-Affected_versions-Patched_versions", "text": "{\"package\":{\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.1.31\",\"patched_versions\":\"8.1.31\"}", "truncated": false, "representation": "normalized_html_fields" }, { "evidenceId": "php:GHSA-c5f2-jwm7-mmq2:html:Package-Affected_versions-Patched_versions", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "sourcePath": "html:Package-Affected_versions-Patched_versions", "text": "{\"package\":{\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.2.26\",\"patched_versions\":\"8.2.26\"}", "truncated": false, "representation": "normalized_html_fields" }, { "evidenceId": "php:GHSA-c5f2-jwm7-mmq2:html:Package-Affected_versions-Patched_versions", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "sourcePath": "html:Package-Affected_versions-Patched_versions", "text": "{\"package\":{\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.3.14\",\"patched_versions\":\"8.3.14\"}", "truncated": false, "representation": "normalized_html_fields" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T21:51:51.580Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "modifiedAt": null, "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。 APIの取得制限時に、同じ開発元の公開HTMLから本文・対象版・修正版を取得しています。HTMLで特定できない更新日時は未確認のままです。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T21:51:51.580Z", "fetchedAt": "2026-10-24T05:05:09.307Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2024-11-21T18:15:25.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:05:09.307Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "5154658bbfa26d2fdcdcefc8ae40b1a380fbb2fd29183cfb8a86e573e6502c38", "sourceModifiedAt": "2025-11-03T21:51:51.580Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1 系列（8.1.31 未満）、8.2 系列（8.2.26 未満）、8.3 系列（8.3.14 未満）で、ストリームを使用しプロキシを設定し request_fulluri オプションを有効にすると、URI が適切にサニタイズされず、HTTP リクエストスミュージングが可能となり、攻撃者がサーバーから任意の HTTP リクエストを実行でき、外部ユーザーが通常アクセスできないリソースに到達できる可能性があります。", "risk": "攻撃者はサーバー上で任意の HTTP リクエストを送信でき、内部エンドポイントや外部からは見えないリソースにアクセスできるようになる恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "ストリーム関数（例: fopen、file、file_get_contents など）でプロキシを設定し、request_fulluri オプションを true にしている場合。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "対象となるリソースの URI が攻撃者に部分的に制御可能である場合。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "FTP ストリームでプロキシを設定すると、request_fulluri が自動的に有効になるケース。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "HTTP ストリームでもプロキシ設定は必須ではないが、request_fulluri が有効になると問題が発生する。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.31未満。影響ありとして記載：8.2系のうち、8.2.26未満。影響ありとして記載：8.3系のうち、8.3.14未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP 8.1.31、8.2.26、8.3.14 以降のバージョンにアップデートして修正を適用する。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2" ], "evidenceIds": [ "E5" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-11234", "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11234", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \"request_fulluri\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "sourceField": "/containers/cna/title", "excerpt": "Configuring a proxy in a stream context might allow for CRLF injection in URIs", "language": null }, { "id": "E3", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "sourceField": "html:.markdown-body.comment-body", "excerpt": "### Summary\n\nConfiguring a proxy in a stream context might allow for CRLF injection in URIs, resulting in HTTP request smuggling attacks.\n\n### Details\n\nWhen creating a stream using one of the available stream creation functions (e.g., fopen , file , file_get_contents ...), developers can specify a custom stream context containing a set of parameters to use during the connection. One such parameter, in the case of HTTP and FTP streams, is proxy . The HTTP context options also include a request_fulluri boolean, which is required by some proxies to correctly forward the request.\n\nWhile a normal request to http://example.com/path/to/file?query would results in the following HTTP request:\n\nwhen setting request_fulluri to true we obtain:\n\nThe vulnerability lies in the implementation of request_fulluri , which just inserts the raw URI into the HTTP request line. In particular, this bypasses the normal control characters sanitization usually performed when parsing the URL .\n\nThis means that, if the resource URI is under the partial control of an attacker, when the request_fulluri context parameter is true, a malicious actor could inject CRLF characters to perform a HTTP request smuggling attack.\n\nFurthermore, if a non-HTTP stream sets a proxy parameter in the context (right now only the FTP context supports this), the request_fulluri parameter gets automatically silently enabled without the developer ever knowing.\n\nNotice that, in the case of HTTP streams, setting a proxy is not strictly necessary, as the real issue is the request_fulluri parameter.\n\n### Impact\n\nCLRF injection in the URI leads to Server Side Request Forgery attacks (SSRF), which allows an attacker to bypass security controls, access internal endpoints, and, since we control the Host: header, potentially access different hosts or machines.\n\nCrafted requests can use any HTTP method and set any header to any value, including sensitive headers like Authorization , Cookie , Origin , or Referer .\n\nMoreover, in some setups, the attacker might be able to read the HTTP response of each of the smuggled request.", "language": "en", "representation": "defensive_html_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11234.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.31\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.26\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.14\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "sourceField": "/fixed", "excerpt": "[\"8.1.31\",\"8.2.26\",\"8.3.14\"]", "language": null } ], "supportRequest": "件名：CVE-2024-11234（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ストリーム関数（例: fopen、file、file_get_contents など）でプロキシを設定し、request_fulluri オプションを true にしている場合。\n・対象となるリソースの URI が攻撃者に部分的に制御可能である場合。\n・FTP ストリームでプロキシを設定すると、request_fulluri が自動的に有効になるケース。\n・HTTP ストリームでもプロキシ設定は必須ではないが、request_fulluri が有効になると問題が発生する。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.31未満。影響ありとして記載：8.2系のうち、8.2.26未満。影響ありとして記載：8.3系のうち、8.3.14未満。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-11234", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:05:09.307Z", "lastSuccess": "2026-10-24T05:05:09.307Z", "sourceCheckedAt": "2026-10-24T05:05:09.307Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-11236", "aliases": [ "GHSA-5hqh-c84r-qjcv" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1.*（8.1.31 未満）、8.2.*（8.2.26 未満）、8.3.*（8.3.14 未満）の 32 ビット環境で、ldap_escape() 関数に長い文字列を渡すと整数オーバーフローが発生し、メモリの範囲外への書き込みが起こります。", "risk": "整数オーバーフローによりメモリの範囲外に書き込まれる可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.31（環境: 32 bit、機能: pdo_firebird / pdo_dblib）" }, { "product": "PHP", "range": "8.2.* / < 8.2.26（環境: 32 bit、機能: pdo_firebird / pdo_dblib）" }, { "product": "PHP", "range": "8.3.* / < 8.3.14（環境: 32 bit、機能: pdo_firebird / pdo_dblib）" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。（環境: 32 bit、機能: pdo_firebird / pdo_dblib）" } ], "fixed": [ "8.1.31", "8.2.26", "8.3.14" ], "steps": [ "PHP を 8.1.31、8.2.26、または 8.3.14 以上のバージョンにアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11236", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-11-21T18:15:20.000Z", "modifiedAt": "2025-11-03T21:51:54.520Z", "fetchedAt": "2026-10-24T05:05:53.007Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.", "sourceTitle": "Integer overflow in the firebird and dblib quoters causing OOB writes", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "modules": [ "pdo_firebird", "pdo_dblib" ], "platforms": [ "32 bit" ], "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.31", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.26", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.14", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: 32 bit / pdo_firebird / pdo_dblib。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-11236", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json", "fetchedAt": "2026-10-24T05:05:53.007Z", "publishedAt": "2024-11-24T00:44:54.951Z", "modifiedAt": "2025-11-03T21:51:54.520Z", "state": "published", "provider": "php", "title": "Integer overflow in the firebird and dblib quoters causing OOB writes", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Impact\r\n\r\nThe following code:\r\nhttps://github.com/php/php-src/blob/5070fbf1613015e351bc4629ac7997b26359320b/ext/pdo_firebird/firebird_driver.c#L805-L808\r\n\r\nand the following code:\r\nhttps://github.com/php/php-src/blob/c34b37fe0b5c099fcf506c5400552d6bbb95cd79/ext/pdo_dblib/dblib_driver.c#L164-L174\r\n\r\nCan cause integer overflow, or can become a value over `ZSTR_MAX_LEN` causing an overflow, which eventually turns into an OOB write. This is triggerable on 32-bit especially.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-5hqh-c84r-qjcv" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [ "32 bit" ], "modules": [ "pdo_firebird", "pdo_dblib" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.14", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.31; patched versions: 8.1.31", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-5hqh-c84r-qjcv" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.26; patched versions: 8.2.26", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-5hqh-c84r-qjcv" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.14; patched versions: 8.3.14", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-5hqh-c84r-qjcv" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20241220-0008/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"modules\":[\"pdo_firebird\",\"pdo_dblib\"],\"platforms\":[\"32 bit\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.31\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.26\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.14\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-787\",\"description\":\"CWE-787 Out-of-bounds Write\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-5hqh-c84r-qjcv:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-5hqh-c84r-qjcv", "sourcePath": "/description", "text": "### Impact\r\n\r\nThe following code:\r\nhttps://github.com/php/php-src/blob/5070fbf1613015e351bc4629ac7997b26359320b/ext/pdo_firebird/firebird_driver.c#L805-L808\r\n\r\nand the following code:\r\nhttps://github.com/php/php-src/blob/c34b37fe0b5c099fcf506c5400552d6bbb95cd79/ext/pdo_dblib/dblib_driver.c#L164-L174\r\n\r\nCan cause integer overflow, or can become a value over `ZSTR_MAX_LEN` causing an overflow, which eventually turns into an OOB write. This is triggerable on 32-bit especially.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-5hqh-c84r-qjcv:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-5hqh-c84r-qjcv", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.31\",\"patched_versions\":\"8.1.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-5hqh-c84r-qjcv:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-5hqh-c84r-qjcv", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.26\",\"patched_versions\":\"8.2.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-5hqh-c84r-qjcv:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-5hqh-c84r-qjcv", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.14\",\"patched_versions\":\"8.3.14\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T21:51:54.520Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-5hqh-c84r-qjcv", "modifiedAt": "2024-11-21T18:15:20.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T21:51:54.520Z", "fetchedAt": "2026-10-24T05:05:53.007Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2024-11-21T18:15:20.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:29:04.613Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "090c8e737d43e8e62e2190b83f17d2e119a6baab2c876ed3984700cc39d9ba98", "sourceModifiedAt": "2025-11-03T21:51:54.520Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.31 未満）、8.2.*（8.2.26 未満）、8.3.*（8.3.14 未満）の 32 ビット環境で、ldap_escape() 関数に長い文字列を渡すと整数オーバーフローが発生し、メモリの範囲外への書き込みが起こります。", "risk": "整数オーバーフローによりメモリの範囲外に書き込まれる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.1.*（8.1.31 未満）を 32 ビットシステムで使用し、ldap_escape() に長い文字列を入力すると脆弱性が発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "PHP 8.2.*（8.2.26 未満）を 32 ビットシステムで使用し、ldap_escape() に長い文字列を入力すると脆弱性が発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "PHP 8.3.*（8.3.14 未満）を 32 ビットシステムで使用し、ldap_escape() に長い文字列を入力すると脆弱性が発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "影響を受けるモジュールは pdo_firebird と pdo_dblib です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.31未満。影響ありとして記載：8.2系のうち、8.2.26未満。影響ありとして記載：8.3系のうち、8.3.14未満。対象の環境：32 bit。対象の機能：pdo_firebird、pdo_dblib。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.31、8.2.26、または 8.3.14 以上のバージョンにアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-11236", "https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11236", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json", "sourceField": "/containers/cna/title", "excerpt": "Integer overflow in the firebird and dblib quoters causing OOB writes", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11236.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"modules\":[\"pdo_firebird\",\"pdo_dblib\"],\"platforms\":[\"32 bit\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.31\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.26\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.14\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv", "sourceField": "/fixed", "excerpt": "[\"8.1.31\",\"8.2.26\",\"8.3.14\"]", "language": null } ], "supportRequest": "件名：CVE-2024-11236（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.*（8.1.31 未満）を 32 ビットシステムで使用し、ldap_escape() に長い文字列を入力すると脆弱性が発生します。\n・PHP 8.2.*（8.2.26 未満）を 32 ビットシステムで使用し、ldap_escape() に長い文字列を入力すると脆弱性が発生します。\n・PHP 8.3.*（8.3.14 未満）を 32 ビットシステムで使用し、ldap_escape() に長い文字列を入力すると脆弱性が発生します。\n・影響を受けるモジュールは pdo_firebird と pdo_dblib です。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.31未満。影響ありとして記載：8.2系のうち、8.2.26未満。影響ありとして記載：8.3系のうち、8.3.14未満。対象の環境：32 bit。対象の機能：pdo_firebird、pdo_dblib。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-11236", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:05:53.007Z", "lastSuccess": "2026-10-24T05:05:53.007Z", "sourceCheckedAt": "2026-10-24T05:05:53.007Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-11233", "aliases": [ "GHSA-r977-prxv-hc43" ], "title": "PHP：脆弱性情報", "summary": "PHP の convert.quoted-printable-decode フィルタでエラーがあり、特定のデータを処理するとバッファを 1 バイトだけ読みすぎる可能性があります。このオーバーリードは、条件次第でクラッシュや他のメモリ領域の内容が漏洩する原因となります。", "risk": "クラッシュや他のメモリ領域の内容が漏洩する可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 4.8, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.31（機能: filters）" }, { "product": "PHP", "range": "8.2.* / < 8.2.26（機能: filters）" }, { "product": "PHP", "range": "8.3.* / < 8.3.14（機能: filters）" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。（機能: filters）" } ], "fixed": [ "8.1.31", "8.2.26", "8.3.14" ], "steps": [ "PHP を 8.1.31、8.2.26、または 8.3.14 にアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11233", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-11-21T18:15:14.000Z", "modifiedAt": "2025-11-03T21:51:48.654Z", "fetchedAt": "2026-10-24T05:05:53.007Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.", "sourceTitle": "Single byte overread with convert.quoted-printable-decode filter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "modules": [ "filters" ], "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.31", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.26", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.14", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: filters。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-11233", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "fetchedAt": "2026-10-24T05:05:53.007Z", "publishedAt": "2024-11-24T01:08:28.663Z", "modifiedAt": "2025-11-03T21:51:48.654Z", "state": "published", "provider": "php", "title": "Single byte overread with convert.quoted-printable-decode filter", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\nA memory-related vulnerability in PHP’s filter handling system, particularly when processing input with convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to extract a single byte of data from the heap or cause a DoS.\n\n### Details\r\nThe issue is caused by a missing bound check.\r\n\r\nThe crash is reliably detected by AddressSanitizer (ASAN), which reports a segmentation fault caused by a read memory access violation. This suggests that there may be an out-of-bounds read or a use-after-free condition in the affected filters. Below is an example stack trace as detected by ASAN:\n\n### Impact\r\nIt affects any systems that use these filters in sequence, especially those processing untrusted user input through php://filter. Systems leveraging this filter chain may be vulnerable to this overrun, and under specific conditions, there is a risk of DoS or information leakage.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [ "filters" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.14", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.31; patched versions: 8.1.31", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.26; patched versions: 8.2.26", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.14; patched versions: 8.3.14", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-122", "lang": "en", "description": "CWE-122 Heap-based Buffer Overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "baseScore": 4.8, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20241220-0008/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"modules\":[\"filters\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.31\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.26\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.14\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-122\",\"description\":\"CWE-122 Heap-based Buffer Overflow\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"LOW\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-r977-prxv-hc43:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "sourcePath": "/description", "text": "### Summary\r\nA memory-related vulnerability in PHP’s filter handling system, particularly when processing input with convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to extract a single byte of data from the heap or cause a DoS.\n\n### Details\r\nThe issue is caused by a missing bound check.\r\n\r\nThe crash is reliably detected by AddressSanitizer (ASAN), which reports a segmentation fault caused by a read memory access violation. This suggests that there may be an out-of-bounds read or a use-after-free condition in the affected filters. Below is an example stack trace as detected by ASAN:\n\n### Impact\r\nIt affects any systems that use these filters in sequence, especially those processing untrusted user input through php://filter. Systems leveraging this filter chain may be vulnerable to this overrun, and under specific conditions, there is a risk of DoS or information leakage.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-r977-prxv-hc43:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.31\",\"patched_versions\":\"8.1.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-r977-prxv-hc43:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.26\",\"patched_versions\":\"8.2.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-r977-prxv-hc43:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.14\",\"patched_versions\":\"8.3.14\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T21:51:48.654Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "modifiedAt": "2024-11-21T18:15:14.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T21:51:48.654Z", "fetchedAt": "2026-10-24T05:05:53.007Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2024-11-21T18:15:14.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:29:06.481Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f3ac02ba5acf2cc3e397e8da8afd3df4c40df2c562284642acb4c2af83ef5b02", "sourceModifiedAt": "2025-11-03T21:51:48.654Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP の convert.quoted-printable-decode フィルタでエラーがあり、特定のデータを処理するとバッファを 1 バイトだけ読みすぎる可能性があります。このオーバーリードは、条件次第でクラッシュや他のメモリ領域の内容が漏洩する原因となります。", "risk": "クラッシュや他のメモリ領域の内容が漏洩する可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "PHP 8.1.* でバージョン 8.1.31 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43" ], "evidenceIds": [ "E4", "E5", "E2" ] }, { "text": "PHP 8.2.* でバージョン 8.2.26 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43" ], "evidenceIds": [ "E4", "E6", "E2" ] }, { "text": "PHP 8.3.* でバージョン 8.3.14 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43" ], "evidenceIds": [ "E4", "E7", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.31未満。影響ありとして記載：8.2系のうち、8.2.26未満。影響ありとして記載：8.3系のうち、8.3.14未満。対象の機能：filters。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.31、8.2.26、または 8.3.14 にアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43" ], "evidenceIds": [ "E8" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-11233", "https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11233", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "sourceField": "/containers/cna/title", "excerpt": "Single byte overread with convert.quoted-printable-decode filter", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "sourceField": "/description", "excerpt": "### Summary\r\nA memory-related vulnerability in PHP’s filter handling system, particularly when processing input with convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to extract a single byte of data from the heap or cause a DoS.\n\n### Details\r\nThe issue is caused by a missing bound check.\r\n\r\nThe crash is reliably detected by AddressSanitizer (ASAN), which reports a segmentation fault caused by a read memory access violation. This suggests that there may be an out-of-bounds read or a use-after-free condition in the affected filters. Below is an example stack trace as detected by ASAN:\n\n### Impact\r\nIt affects any systems that use these filters in sequence, especially those processing untrusted user input through php://filter. Systems leveraging this filter chain may be vulnerable to this overrun, and under specific conditions, there is a risk of DoS or information leakage.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11233.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"modules\":[\"filters\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.31\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.26\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.14\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "sourceField": "/vulnerabilities/0", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.31\",\"patched_versions\":\"8.1.31\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "sourceField": "/vulnerabilities/1", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.26\",\"patched_versions\":\"8.2.26\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r977-prxv-hc43", "sourceField": "/vulnerabilities/2", "excerpt": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.14\",\"patched_versions\":\"8.3.14\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43", "sourceField": "/fixed", "excerpt": "[\"8.1.31\",\"8.2.26\",\"8.3.14\"]", "language": null } ], "supportRequest": "件名：CVE-2024-11233（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.* でバージョン 8.1.31 未満は影響を受けます。\n・PHP 8.2.* でバージョン 8.2.26 未満は影響を受けます。\n・PHP 8.3.* でバージョン 8.3.14 未満は影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.31未満。影響ありとして記載：8.2系のうち、8.2.26未満。影響ありとして記載：8.3系のうち、8.3.14未満。対象の機能：filters。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-11233", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:05:53.007Z", "lastSuccess": "2026-10-24T05:05:53.007Z", "sourceCheckedAt": "2026-10-24T05:05:53.007Z", "errorCode": null }, "glossary": [] } } ], "total": 2264, "limit": 20, "offset": 1000, "filters": { "product": "all", "type": "all", "q": "", "page": 51 }, "pagination": { "page": 51, "pageSize": 20, "totalPages": 114 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-24T19:17:49.633Z", "lastAttempt": "2026-10-24T19:17:49.633Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-24T19:17:49.633Z", "lastAttempt": "2026-10-24T19:17:49.633Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-24T19:17:49.633Z", "lastAttempt": "2026-10-24T19:17:49.633Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "partial", "lastSuccess": "2026-10-24T13:17:49.742Z", "lastAttempt": "2026-10-24T19:17:49.633Z", "error": "未確認のページ・期間は次回の定期取得で続きから反映します。", "recordCount": 7, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-24T13:02:49.742Z 〜 2026-10-24T16:17:49.075Z、全製品の変更 2000/2744件まで確認、対象7件反映。", "cursor": { "start": "2026-10-24T13:02:49.742Z", "end": "2026-10-24T16:17:49.075Z", "kind": "modified", "index": 2000 }, "freshness": "stale", "stale": true }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-24T19:17:49.633Z", "lastAttempt": "2026-10-24T19:17:49.633Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }