{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2020-15415", "aliases": [], "title": "n/a：脆弱性情報", "summary": "DrayTek Vigor3900、Vigor2960、Vigor300B の 1.5.1 未満のファームウェアを搭載したデバイスでは、text/x-python-script コンテンツタイプでアップロードされたファイル名にシェルのメタ文字が含まれると、cgi-bin/mainfunction.cgi/cvmcfgupload がリモートでコマンドを実行できる。", "risk": "攻撃者はこの脆弱性を利用して、デバイス上で任意のコードを実行できる可能性がある。", "product": "DrayTek Multiple Vigor Routers", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "「CVE-2020-15415」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-15415", "label": "CVE公式レコード" }, { "url": "https://www.draytek.com/about/security-advisory", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/CLP-team/Vigor-Commond-Injection", "label": "CVE掲載の参考情報" }, { "url": "https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15415", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2020-06-30T13:37:56.000Z", "modifiedAt": "2025-10-21T23:35:41.567Z", "fetchedAt": "2026-10-24T05:08:20.672Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2020-15415", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json", "fetchedAt": "2026-10-24T05:08:20.672Z", "publishedAt": "2020-06-30T13:37:56.000Z", "modifiedAt": "2025-10-21T23:35:41.567Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.draytek.com/about/security-advisory", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/CLP-team/Vigor-Commond-Injection", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15415", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2020-15415:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "sourcePath": "retained:/originalText", "text": "DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2020-15415:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "modifiedAt": "2024-09-30T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:35:41.567Z", "fetchedAt": "2026-10-24T05:08:20.672Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-30T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:08:20.672Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "29260df5b47cf972481cf881499332724a2d04afe7153f8e92d8ccac8703350d", "sourceModifiedAt": "2025-10-21T23:35:41.567Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "DrayTek Vigor3900、Vigor2960、Vigor300B の 1.5.1 未満のファームウェアを搭載したデバイスでは、text/x-python-script コンテンツタイプでアップロードされたファイル名にシェルのメタ文字が含まれると、cgi-bin/mainfunction.cgi/cvmcfgupload がリモートでコマンドを実行できる。", "risk": "攻撃者はこの脆弱性を利用して、デバイス上で任意のコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象は DrayTek Vigor3900、Vigor2960、Vigor300B の各機種で、ファームウェアバージョンが 1.5.1 未満であること。攻撃には text/x-python-script コンテンツタイプを使用し、ファイル名にシェルメタ文字を含めてアップロードする必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json" ], "evidenceIds": [ "E3" ] }, { "text": "「DrayTek Multiple Vigor Routers」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-15415", "https://www.draytek.com/about/security-advisory", "https://github.com/CLP-team/Vigor-Commond-Injection", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472", "https://nvd.nist.gov/vuln/detail/CVE-2020-15415" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2020-15415」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2020-15415", "https://www.draytek.com/about/security-advisory", "https://github.com/CLP-team/Vigor-Commond-Injection", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472", "https://nvd.nist.gov/vuln/detail/CVE-2020-15415" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-15415", "https://www.draytek.com/about/security-advisory", "https://github.com/CLP-team/Vigor-Commond-Injection", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472", "https://nvd.nist.gov/vuln/detail/CVE-2020-15415" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2020-15415", "https://www.draytek.com/about/security-advisory", "https://github.com/CLP-team/Vigor-Commond-Injection", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472", "https://nvd.nist.gov/vuln/detail/CVE-2020-15415" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-15415", "https://www.draytek.com/about/security-advisory", "https://github.com/CLP-team/Vigor-Commond-Injection", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472", "https://nvd.nist.gov/vuln/detail/CVE-2020-15415" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-15415", "label": "CVE公式レコード" }, { "url": "https://www.draytek.com/about/security-advisory", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/CLP-team/Vigor-Commond-Injection", "label": "CVE掲載の参考情報" }, { "url": "https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15415", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "sourceField": "retained:/originalText", "excerpt": "DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15415.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-15415", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2020-15415\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2020-15415（DrayTek Multiple Vigor Routers）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は DrayTek Vigor3900、Vigor2960、Vigor300B の各機種で、ファームウェアバージョンが 1.5.1 未満であること。攻撃には text/x-python-script コンテンツタイプを使用し、ファイル名にシェルメタ文字を含めてアップロードする必要がある。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2020-15415", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:08:20.672Z", "lastSuccess": "2026-10-24T05:08:20.672Z", "sourceCheckedAt": "2026-10-24T05:08:20.672Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-25280", "aliases": [], "title": "n/a：コード実行", "summary": "D-Link DIR-820 ルーターのファームウェア DIR820LA1_FW105B03 に OS コマンドインジェクションの脆弱性があり、攻撃者は ping.ccp の ping_addr パラメータに細工したペイロードを送ることで、ルーター上で root 権限に昇格させることができる。", "risk": "攻撃者が root 権限を取得すると、ルーター上で任意のコマンドを実行できるようになる。", "product": "D-Link DIR-820 Router", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "対象製品は既に製造終了（EoL）またはサービス終了（EoS）となっているため、使用を中止すべきである。", "「CVE-2023-25280」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-25280", "label": "CVE公式レコード" }, { "url": "https://www.dlink.com/en/security-bulletin/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg", "label": "CVE掲載の参考情報" }, { "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25280", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-03-16T00:00:00.000Z", "modifiedAt": "2025-10-21T23:15:22.929Z", "fetchedAt": "2026-10-24T05:08:31.524Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-25280", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json", "fetchedAt": "2026-10-24T05:08:31.524Z", "publishedAt": "2023-03-16T00:00:00.000Z", "modifiedAt": "2025-10-21T23:15:22.929Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.dlink.com/en/security-bulletin/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25280", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"text\",\"lang\":\"en\",\"description\":\"n/a\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-25280:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "sourcePath": "retained:/originalText", "text": "D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-25280:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "sourcePath": "retained:/sourceAction", "text": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "modifiedAt": "2024-09-30T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:15:22.929Z", "fetchedAt": "2026-10-24T05:08:31.524Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-30T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:08:31.524Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7f1d60b57dd1660128610f6ef983e70f5b4cf3b782d2e94eb8ab14184afa96cc", "sourceModifiedAt": "2025-10-21T23:15:22.929Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "D-Link DIR-820 ルーターのファームウェア DIR820LA1_FW105B03 に OS コマンドインジェクションの脆弱性があり、攻撃者は ping.ccp の ping_addr パラメータに細工したペイロードを送ることで、ルーター上で root 権限に昇格させることができる。", "risk": "攻撃者が root 権限を取得すると、ルーター上で任意のコマンドを実行できるようになる。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "リモートの認証されていない攻撃者が、ping.ccp の ping_addr パラメータに細工したペイロードを送信できる環境、かつ対象ファームウェアが DIR820LA1_FW105B03 の D-Link DIR-820 ルーター。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json" ], "evidenceIds": [ "E3" ] }, { "text": "「D-Link DIR-820 Router」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-25280", "https://www.dlink.com/en/security-bulletin/", "https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358", "https://nvd.nist.gov/vuln/detail/CVE-2023-25280" ] } ], "actions": [ { "text": "対象製品は既に製造終了（EoL）またはサービス終了（EoS）となっているため、使用を中止すべきである。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2023-25280」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-25280", "https://www.dlink.com/en/security-bulletin/", "https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358", "https://nvd.nist.gov/vuln/detail/CVE-2023-25280" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-25280", "https://www.dlink.com/en/security-bulletin/", "https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358", "https://nvd.nist.gov/vuln/detail/CVE-2023-25280" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-25280", "https://www.dlink.com/en/security-bulletin/", "https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358", "https://nvd.nist.gov/vuln/detail/CVE-2023-25280" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-25280", "https://www.dlink.com/en/security-bulletin/", "https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358", "https://nvd.nist.gov/vuln/detail/CVE-2023-25280" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-25280", "label": "CVE公式レコード" }, { "url": "https://www.dlink.com/en/security-bulletin/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg", "label": "CVE掲載の参考情報" }, { "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25280", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "sourceField": "retained:/originalText", "excerpt": "D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/25xxx/CVE-2023-25280.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "sourceField": "retained:/sourceAction", "excerpt": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-25280", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-25280\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-25280（D-Link DIR-820 Router）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの認証されていない攻撃者が、ping.ccp の ping_addr パラメータに細工したペイロードを送信できる環境、かつ対象ファームウェアが DIR820LA1_FW105B03 の D-Link DIR-820 ルーター。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-25280", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:08:31.524Z", "lastSuccess": "2026-10-24T05:08:31.524Z", "sourceCheckedAt": "2026-10-24T05:08:31.524Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-4577", "aliases": [ "GHSA-3qgc-jrrr-25jv" ], "title": "PHP：コード実行", "summary": "PHP 8.1.*（8.1.29 未満）、8.2.*（8.2.20 未満）、8.3.*（8.3.8 未満）で、Windows 上の Apache と PHP‑CGI を組み合わせて使用している場合、システムが特定のコードページに設定されていると、Windows がコマンドライン文字列に対して「Best‑Fit」変換を行うことがあります。この変換により PHP‑CGI モジュールが文字を PHP オプションと誤認識し、攻撃者が PHP バイナリに任意のオプションを渡すことができ、スクリプトのソースコードが漏洩したり、サーバー上で任意の PHP コードを実行されたりする可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、サーバー上で任意の PHP コードを実行でき、スクリプトのソースコードが漏洩する恐れがあります。", "product": "PHP", "category": "php", "component": "core", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.29（環境: Windows、機能: CGI）" }, { "product": "PHP", "range": "8.2.* / < 8.2.20（環境: Windows、機能: CGI）" }, { "product": "PHP", "range": "8.3.* / < 8.3.8（環境: Windows、機能: CGI）" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。（環境: Windows、機能: CGI）" } ], "fixed": [ "8.3.8", "8.2.20", "8.1.29" ], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json", "label": "CVE：php" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4577", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-4577", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv", "label": "PHP開発元のアドバイザリ" }, { "url": "https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html", "label": "CVE掲載の参考情報" }, { "url": "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/", "label": "CVE掲載の参考情報" }, { "url": "https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/", "label": "CVE掲載の参考情報" }, { "url": "https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/11whoami99/CVE-2024-4577", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/xcanwin/CVE-2024-4577-PHP-RCE", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/rapid7/metasploit-framework/pull/19247", "label": "CVE掲載の参考情報" }, { "url": "https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/watchtowrlabs/CVE-2024-4577", "label": "CVE掲載の参考情報" }, { "url": "https://www.php.net/ChangeLog-8.php#", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4577", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-06-09T19:42:36.464Z", "modifiedAt": "2025-10-21T23:05:16.089Z", "fetchedAt": "2026-10-24T05:08:38.081Z", "exploitStatus": "confirmed", "sources": [ "CVE", "PHP Security", "CISA KEV" ], "originalText": "In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.", "sourceTitle": "Argument Injection in PHP-CGI", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "modules": [ "CGI" ], "platforms": [ "Windows" ], "product": "PHP", "repo": "https://github.com/php/php-src", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.29", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.20", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.8", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: Windows / CGI。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-4577", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json", "fetchedAt": "2026-10-24T05:08:38.081Z", "publishedAt": "2024-06-09T19:42:36.464Z", "modifiedAt": "2025-10-21T23:05:16.089Z", "state": "published", "provider": "php", "title": "Argument Injection in PHP-CGI", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Hi, \r\n\r\nI am Orange Tsai from DEVCORE Research Team. We recently found a vulnerability on PHP. We have reproduced the issues in the latest version of PHP 8.3.6 and would like to report it to you. Please check the attached document for details.\r\n\r\nThis advisory is in accordance with our vulnerability disclosure policy, which will be publicly disclosed after 90 days. Our aim is to ensure that vulnerabilities can be patched in a timely manner. Although it’s not a hard deadline, we still hope you can fix this vulnerability before August 04, 2024.\r\n\r\nPlease let me know if you have any questions, thanks!\n\n# Impact\r\n\r\nAn attacker can execute arbitrary PHP code on the remote server. This vulnerability affects the PHP built with Windows.\n\n# Details\r\n\r\nThe PHP-CGI which configured under Apache HTTP Server accepts the command-line arguments by default. This behavior was prove to vulnerable, and tracked as [CVE-2012-1823](https://bugs.php.net/bug.php?id=61910) before. The PHP published the following code to patch the vulnerability:\r\n\r\n***# Path: sapi/cgi/cgi_main.c:1801** https://github.com/php/php-src/blob/php-8.0.30/sapi/cgi/cgi_main.c#L1801*\r\n\r\n\r\n\r\nThis argument `argv` is based on the `QUERY_STRING`, and the patch checks for no leading hyphen on the `QUERY_STRING` to ensure there are no dangerous arguments. However, if the binding between `argv` and `QUERY_STRING` is broken, the vulnerability of PHP-CGI Argument Injection would reappear!\r\n\r\nThis patch will fail under the Windows system. Internally, Windows uses UCS-2 as its character set. Any characters passed to the ANSI Win32 API (such as `GetCommandLineA`), especially those with code point greater than 0x80, will be mapped to the corresponding UCS-2 code points by the current code page.\r\n\r\nThe Windows internal also introduces a \"Best-Fit\" feature that replace the character if there is a more suitable character to display in the destination code page. \r\n\r\nThe description and specification can be found here:\r\n* [WindowsBestFit/readme.txt](https://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/readme.txt)\r\n* [2.2.2.1.1 WCTABLE](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ucoderef/d1980631-6401-428e-a49d-d71394be7da8)\r\n\r\nThis \"Best-Fit\" behavior also introduces some quirks to bypass the original fix. For example: the best-fit replacement of the code point 0xAD (soft-hyphen) is the normal hyphen 0x2D under the code page 932, 936 and 950. That leads to the bypass. \r\n\r\nFor a default PHP-CGI configuration under Apache HTTP Server + Windows, the original PoC would no longer work because of the patch of CVE-2012-1823.\r\n> http://server/index.php?-s\r\n\r\nHowever, if the attacker change the `-` to `%ad`, it bypasses the patch and inject `-s` to show the PHP source code...\r\n> `http://server/index.php?%ads`\r\n\r\nHere is a small PoC to demonstrate the quirk:\r\n\r\n\r\n\r\nYou can build it under the Visual Studio, and check the above quirk:\n\n## 1. Check the Windows 11 is the latest version\r\n\r\n![image](https://github.com/php/php-src/assets/3805558/e5eb2bfb-6628-427c-aabc-ca8f6763f350)\n\n## 2. Ensure the locale is in one of the vulnerable region from `Windows` -> `Settings` -> `Time & language` -> `Language & region` -> `Administrative language settings` -> `Change system locale...`. Here we use Japan as an example. \r\n\r\n![image](https://github.com/php/php-src/assets/3805558/080bf2ee-ca78-4122-ac8f-f84b99559192)\n\n## 3. Exploit scenarios:\n\n### 3-1. If the target server is running under the PHP-CGI mode, you can just verify the vulnerability by appending the `-s` option:\r\n\r\n> `http://server/index.php?%ads`\r\n\r\n![image](https://github.com/php/php-src/assets/3805558/ec6513fe-8620-4a25-bd2a-f35a788d1303)\n\n### 3-2. If the `php-cgi.exe` is exposed externally, it can also be exploited without any additional change. XAMPP is exactly in this situation. The default XAMPP installation is VULNERABLE BY DEFAULT. You can just install the latest version of XAMPP [here](https://www.apachefriends.org/download.html), and get arbitrary PHP code execution by `auto_prepend_file`:\r\n\r\n> `http://server/php-cgi/php-cgi.exe?%add+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input`\r\n\r\n*PS: Please note the `Redirect-Status` header matters.*\r\n\r\n![image](https://github.com/php/php-src/assets/3805558/c320768a-a9aa-4d8c-b60b-6c25db8fae4e)\n\n# Credit Discovery To\r\nOrange Tsai ([@orange_8361](https://twitter.com/orange_8361)) from DEVCORE Research Team", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3qgc-jrrr-25jv" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "repo": "https://github.com/php/php-src", "defaultStatus": "affected", "platforms": [ "Windows" ], "modules": [ "CGI" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.29", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.20", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.8", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.8; patched versions: 8.3.8", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3qgc-jrrr-25jv" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.20; patched versions: 8.2.20", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3qgc-jrrr-25jv" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.29; patched versions: 8.1.29", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3qgc-jrrr-25jv" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/4" }, { "url": "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/5" }, { "url": "https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/6" }, { "url": "https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/7" }, { "url": "https://github.com/11whoami99/CVE-2024-4577", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/8" }, { "url": "https://github.com/xcanwin/CVE-2024-4577-PHP-RCE", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/9" }, { "url": "https://github.com/rapid7/metasploit-framework/pull/19247", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/10" }, { "url": "https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/11" }, { "url": "https://github.com/watchtowrlabs/CVE-2024-4577", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/12" }, { "url": "https://www.php.net/ChangeLog-8.php#8.1.29", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/13" }, { "url": "https://www.php.net/ChangeLog-8.php#8.2.20", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/14" }, { "url": "https://www.php.net/ChangeLog-8.php#8.3.8", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/15" }, { "url": "https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/16" }, { "url": "https://isc.sans.edu/diary/30994", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/17" }, { "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/18" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/19" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/20" }, { "url": "https://security.netapp.com/advisory/ntap-20240621-0008/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/21" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://blog.talosintelligence.com/new-persistent-attacks-japan/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"modules\":[\"CGI\"],\"platforms\":[\"Windows\"],\"product\":\"PHP\",\"repo\":\"https://github.com/php/php-src\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.29\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.20\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.8\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-78\",\"description\":\"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-4577:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4577", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "php:GHSA-3qgc-jrrr-25jv:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3qgc-jrrr-25jv", "sourcePath": "/description", "text": "Hi, \r\n\r\nI am Orange Tsai from DEVCORE Research Team. We recently found a vulnerability on PHP. We have reproduced the issues in the latest version of PHP 8.3.6 and would like to report it to you. Please check the attached document for details.\r\n\r\nThis advisory is in accordance with our vulnerability disclosure policy, which will be publicly disclosed after 90 days. Our aim is to ensure that vulnerabilities can be patched in a timely manner. Although it’s not a hard deadline, we still hope you can fix this vulnerability before August 04, 2024.\r\n\r\nPlease let me know if you have any questions, thanks!\n\n# Impact\r\n\r\nAn attacker can execute arbitrary PHP code on the remote server. This vulnerability affects the PHP built with Windows.\n\n# Details\r\n\r\nThe PHP-CGI which configured under Apache HTTP Server accepts the command-line arguments by default. This behavior was prove to vulnerable, and tracked as [CVE-2012-1823](https://bugs.php.net/bug.php?id=61910) before. The PHP published the following code to patch the vulnerability:\r\n\r\n***# Path: sapi/cgi/cgi_main.c:1801** https://github.com/php/php-src/blob/php-8.0.30/sapi/cgi/cgi_main.c#L1801*\r\n\r\n\r\n\r\nThis argument `argv` is based on the `QUERY_STRING`, and the patch checks for no leading hyphen on the `QUERY_STRING` to ensure there are no dangerous arguments. However, if the binding between `argv` and `QUERY_STRING` is broken, the vulnerability of PHP-CGI Argument Injection would reappear!\r\n\r\nThis patch will fail under the Windows system. Internally, Windows uses UCS-2 as its character set. Any characters passed to the ANSI Win32 API (such as `GetCommandLineA`), especially those with code point greater than 0x80, will be mapped to the corresponding UCS-2 code points by the current code page.\r\n\r\nThe Windows internal also introduces a \"Best-Fit\" feature that replace the character if there is a more suitable character to display in the destination code page. \r\n\r\nThe description and specification can be found here:\r\n* [WindowsBestFit/readme.txt](https://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/readme.txt)\r\n* [2.2.2.1.1 WCTABLE](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ucoderef/d1980631-6401-428e-a49d-d71394be7da8)\r\n\r\nThis \"Best-Fit\" behavior also introduces some quirks to bypass the original fix. For example: the best-fit replacement of the code point 0xAD (soft-hyphen) is the normal hyphen 0x2D under the code page 932, 936 and 950. That leads to the bypass. \r\n\r\nFor a default PHP-CGI configuration under Apache HTTP Server + Windows, the original PoC would no longer work because of the patch of CVE-2012-1823.\r\n> http://server/index.php?-s\r\n\r\nHowever, if the attacker change the `-` to `%ad`, it bypasses the patch and inject `-s` to show the PHP source code...\r\n> `http://server/index.php?%ads`\r\n\r\nHere is a small PoC to demonstrate the quirk:\r\n\r\n\r\n\r\nYou can build it under the Visual Studio, and check the above quirk:\n\n## 1. Check the Windows 11 is the latest version\r\n\r\n![image](https://github.com/php/php-src/assets/3805558/e5eb2bfb-6628-427c-aabc-ca8f6763f350)\n\n## 2. Ensure the locale is in one of the vulnerable region from `Windows` -> `Settings` -> `Time & language` -> `Language & region` -> `Administrative language settings` -> `Change system locale...`. Here we use Japan as an example. \r\n\r\n![image](https://github.com/php/php-src/assets/3805558/080bf2ee-ca78-4122-ac8f-f84b99559192)\n\n## 3. Exploit scenarios:\n\n### 3-1. If the target server is running under the PHP-CGI mode, you can just verify the vulnerability by appending the `-s` option:\r\n\r\n> `http://server/index.php?%ads`\r\n\r\n![image](https://github.com/php/php-src/assets/3805558/ec6513fe-8620-4a25-bd2a-f35a788d1303)\n\n### 3-2. If the `php-cgi.exe` is exposed externally, it can also be exploited without any additional change. XAMPP is exactly in this situation. The default XAMPP installation is VULNERABLE BY DEFAULT. You can just install the latest version of XAMPP [here](https://www.apachefriends.org/download.html), and get arbitrary PHP code execution by `auto_prepend_file`:\r\n\r\n> `http://server/php-cgi/php-cgi.exe?%add+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input`\r\n\r\n*PS: Please note the `Redirect-Status` header matters.*\r\n\r\n![image](https://github.com/php/php-src/assets/3805558/c320768a-a9aa-4d8c-b60b-6c25db8fae4e)\n\n# Credit Discovery To\r\nOrange Tsai ([@orange_8361](https://twitter.com/orange_8361)) from DEVCORE Research Team", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-3qgc-jrrr-25jv:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3qgc-jrrr-25jv", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.8\",\"patched_versions\":\"8.3.8\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3qgc-jrrr-25jv:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3qgc-jrrr-25jv", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.20\",\"patched_versions\":\"8.2.20\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-3qgc-jrrr-25jv:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3qgc-jrrr-25jv", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.29\",\"patched_versions\":\"8.1.29\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4577", "modifiedAt": "2024-09-28T17:37:20.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true }, { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-3qgc-jrrr-25jv", "modifiedAt": "2024-09-28T17:37:20.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ], "primaryModifiedAt": "2025-10-21T23:05:16.089Z" }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:16.089Z", "fetchedAt": "2026-10-24T05:08:38.081Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2024-09-28T17:37:20.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-28T17:37:20.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "PHPにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:08:38.081Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "1d089d7413f4a04ac6da902967ce23e42b0b3e1b60259fe8c0ae6898eb7f44e1", "sourceModifiedAt": "2025-10-21T23:05:16.089Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.29 未満）、8.2.*（8.2.20 未満）、8.3.*（8.3.8 未満）で、Windows 上の Apache と PHP‑CGI を組み合わせて使用している場合、システムが特定のコードページに設定されていると、Windows がコマンドライン文字列に対して「Best‑Fit」変換を行うことがあります。この変換により PHP‑CGI モジュールが文字を PHP オプションと誤認識し、攻撃者が PHP バイナリに任意のオプションを渡すことができ、スクリプトのソースコードが漏洩したり、サーバー上で任意の PHP コードを実行されたりする可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、サーバー上で任意の PHP コードを実行でき、スクリプトのソースコードが漏洩する恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は Windows 環境で Apache と PHP‑CGI を組み合わせて使用している PHP 8.1.*（8.1.29 未満）、8.2.*（8.2.20 未満）、8.3.*（8.3.8 未満）です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "システムのロケールが特定のコードページに設定されており、Windows が「Best‑Fit」変換を行う場合に脆弱性が顕在化します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者は HTTP リクエストのクエリ文字列に特殊なエンコード（例: %ad）を含めて、PHP‑CGI に対してオプション（例: -s）を注入できる必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.29未満。影響ありとして記載：8.2系のうち、8.2.20未満。影響ありとして記載：8.3系のうち、8.3.8未満。対象の環境：Windows。対象の機能：CGI。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4577" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4577" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-4577", "https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv", "https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html", "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/", "https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/", "https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/", "https://github.com/11whoami99/CVE-2024-4577", "https://github.com/xcanwin/CVE-2024-4577-PHP-RCE", "https://github.com/rapid7/metasploit-framework/pull/19247", "https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/", "https://github.com/watchtowrlabs/CVE-2024-4577", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4577", "https://www.php.net/ChangeLog-8.php#", "https://nvd.nist.gov/vuln/detail/CVE-2024-4577" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json", "label": "CVE：php" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4577", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-4577", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv", "label": "PHP開発元のアドバイザリ" }, { "url": "https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html", "label": "CVE掲載の参考情報" }, { "url": "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/", "label": "CVE掲載の参考情報" }, { "url": "https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/", "label": "CVE掲載の参考情報" }, { "url": "https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/11whoami99/CVE-2024-4577", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/xcanwin/CVE-2024-4577-PHP-RCE", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/rapid7/metasploit-framework/pull/19247", "label": "CVE掲載の参考情報" }, { "url": "https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/watchtowrlabs/CVE-2024-4577", "label": "CVE掲載の参考情報" }, { "url": "https://www.php.net/ChangeLog-8.php#", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4577", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json", "sourceField": "/containers/cna/title", "excerpt": "Argument Injection in PHP-CGI", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4577.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"modules\":[\"CGI\"],\"platforms\":[\"Windows\"],\"product\":\"PHP\",\"repo\":\"https://github.com/php/php-src\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.29\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.20\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.8\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4577", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4577", "sourceField": "/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4577", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-4577\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-4577（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Windows 環境で Apache と PHP‑CGI を組み合わせて使用している PHP 8.1.*（8.1.29 未満）、8.2.*（8.2.20 未満）、8.3.*（8.3.8 未満）です。\n・システムのロケールが特定のコードページに設定されており、Windows が「Best‑Fit」変換を行う場合に脆弱性が顕在化します。\n・攻撃者は HTTP リクエストのクエリ文字列に特殊なエンコード（例: %ad）を含めて、PHP‑CGI に対してオプション（例: -s）を注入できる必要があります。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.29未満。影響ありとして記載：8.2系のうち、8.2.20未満。影響ありとして記載：8.3系のうち、8.3.8未満。対象の環境：Windows。対象の機能：CGI。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-4577", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:08:38.081Z", "lastSuccess": "2026-10-24T05:08:38.081Z", "sourceCheckedAt": "2026-10-24T05:08:38.081Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-8927", "aliases": [ "GHSA-94p6-54jq-9mwp" ], "title": "PHP：脆弱性情報", "summary": "PHP の cgi.force_redirect 設定は、HTTP ヘッダーから送信できる HTTP_REDIRECT_STATUS 変数と衝突するため、回避できる可能性があります。リクエスト送信者が HTTP ヘッダーでこの変数の内容を制御できるシナリオがあります。", "risk": "特定の設定下では、任意のファイルを PHP に読み込ませる（任意ファイルインクルージョ）につながる可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.30" }, { "product": "PHP", "range": "8.2.* / < 8.2.24" }, { "product": "PHP", "range": "8.3.* / < 8.3.12" } ], "fixed": [ "8.1.30", "8.2.24", "8.3.12" ], "steps": [ "PHP を 8.1.30、8.2.24、または 8.3.12 以上にアップデートして修正を適用してください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8927", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-09-27T17:51:24.000Z", "modifiedAt": "2025-11-03T22:33:09.411Z", "fetchedAt": "2026-10-24T05:08:38.226Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.", "sourceTitle": "cgi.force_redirect configuration is bypassable due to the environment variable collision", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.30", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.24", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.12", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-8927", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json", "fetchedAt": "2026-10-24T05:08:38.226Z", "publishedAt": "2024-10-08T03:56:31.849Z", "modifiedAt": "2025-11-03T22:33:09.411Z", "state": "published", "provider": "php", "title": "cgi.force_redirect configuration is bypassable due to the environment variable collision", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\nAccording to , the configuration directive [`cgi.force_redirect`](https://www.php.net/manual/en/ini.core.php#ini.cgi.force-redirect) prevents anyone from calling PHP directly with a URL like `http://host.example/cgi-bin/php/secretdir/script.php`. \r\nThe default value of `cgi.force_redirect` is `1`.\r\n\r\nBut there is a bug that can cause attackers to bypass restrictions and access php-cgi directly.\n\n### Details\r\n\r\nBoth `REDIRECT_STATUS` or `HTTP_REDIRECT_STATUS` are considered legal environment variable while `cgi.force_redirect` is turned on:\r\n\r\nhttps://github.com/php/php-src/blob/master/sapi/cgi/cgi_main.c#L1905\r\n\r\n\r\n\r\nUnexpectedly, `Redirect-Status` header is converted to the `HTTP_REDIRECT_STATUS` environment variable, allowing the attacker to bypass the `cgi.force_redirect` variable through HTTP headers.\n\n### Impact\r\nThe `cgi.force_redirect` configuration can be bypassed.\r\n\r\nWhile this does not pose significant security risks in most common configurations, certain configurations that modifies the `SCRIPT_FILENAME` environment variable may allow the arbitrary file inclusion.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.30", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.24", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.12", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.30; patched versions: 8.1.30", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.24; patched versions: 8.2.24", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.12; patched versions: 8.3.12", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20241101-0003/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.30\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.24\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.12\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-94p6-54jq-9mwp:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp", "sourcePath": "/description", "text": "### Summary\r\nAccording to , the configuration directive [`cgi.force_redirect`](https://www.php.net/manual/en/ini.core.php#ini.cgi.force-redirect) prevents anyone from calling PHP directly with a URL like `http://host.example/cgi-bin/php/secretdir/script.php`. \r\nThe default value of `cgi.force_redirect` is `1`.\r\n\r\nBut there is a bug that can cause attackers to bypass restrictions and access php-cgi directly.\n\n### Details\r\n\r\nBoth `REDIRECT_STATUS` or `HTTP_REDIRECT_STATUS` are considered legal environment variable while `cgi.force_redirect` is turned on:\r\n\r\nhttps://github.com/php/php-src/blob/master/sapi/cgi/cgi_main.c#L1905\r\n\r\n\r\n\r\nUnexpectedly, `Redirect-Status` header is converted to the `HTTP_REDIRECT_STATUS` environment variable, allowing the attacker to bypass the `cgi.force_redirect` variable through HTTP headers.\n\n### Impact\r\nThe `cgi.force_redirect` configuration can be bypassed.\r\n\r\nWhile this does not pose significant security risks in most common configurations, certain configurations that modifies the `SCRIPT_FILENAME` environment variable may allow the arbitrary file inclusion.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-94p6-54jq-9mwp:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.30\",\"patched_versions\":\"8.1.30\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-94p6-54jq-9mwp:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.24\",\"patched_versions\":\"8.2.24\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-94p6-54jq-9mwp:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.12\",\"patched_versions\":\"8.3.12\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T22:33:09.411Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp", "modifiedAt": "2024-09-27T17:51:24.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T22:33:09.411Z", "fetchedAt": "2026-10-24T05:08:38.226Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2024-09-27T17:51:24.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:29:48.090Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "191d6052997c4c13c51e0e33f08b8a97a9eebc300a32c855e08532e88232739b", "sourceModifiedAt": "2025-11-03T22:33:09.411Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP の cgi.force_redirect 設定は、HTTP ヘッダーから送信できる HTTP_REDIRECT_STATUS 変数と衝突するため、回避できる可能性があります。リクエスト送信者が HTTP ヘッダーでこの変数の内容を制御できるシナリオがあります。", "risk": "特定の設定下では、任意のファイルを PHP に読み込ませる（任意ファイルインクルージョ）につながる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "PHP 8.1.* のバージョンで 8.1.30 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.2.* のバージョンで 8.2.24 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP 8.3.* のバージョンで 8.3.12 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.30未満。影響ありとして記載：8.2系のうち、8.2.24未満。影響ありとして記載：8.3系のうち、8.3.12未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.1.30、8.2.24、または 8.3.12 以上にアップデートして修正を適用してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp" ], "evidenceIds": [ "E5" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-8927", "https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8927", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json", "sourceField": "/containers/cna/title", "excerpt": "cgi.force_redirect configuration is bypassable due to the environment variable collision", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-94p6-54jq-9mwp", "sourceField": "/description", "excerpt": "### Summary\r\nAccording to , the configuration directive [`cgi.force_redirect`](https://www.php.net/manual/en/ini.core.php#ini.cgi.force-redirect) prevents anyone from calling PHP directly with a URL like `http://host.example/cgi-bin/php/secretdir/script.php`. \r\nThe default value of `cgi.force_redirect` is `1`.\r\n\r\nBut there is a bug that can cause attackers to bypass restrictions and access php-cgi directly.\n\n### Details\r\n\r\nBoth `REDIRECT_STATUS` or `HTTP_REDIRECT_STATUS` are considered legal environment variable while `cgi.force_redirect` is turned on:\r\n\r\nhttps://github.com/php/php-src/blob/master/sapi/cgi/cgi_main.c#L1905\r\n\r\n\r\n\r\nUnexpectedly, `Redirect-Status` header is converted to the `HTTP_REDIRECT_STATUS` environment variable, allowing the attacker to bypass the `cgi.force_redirect` variable through HTTP headers.\n\n### Impact\r\nThe `cgi.force_redirect` configuration can be bypassed.\r\n\r\nWhile this does not pose significant security risks in most common configurations, certain configurations that modifies the `SCRIPT_FILENAME` environment variable may allow the arbitrary file inclusion.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8927.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.30\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.24\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.12\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp", "sourceField": "/fixed", "excerpt": "[\"8.1.30\",\"8.2.24\",\"8.3.12\"]", "language": null } ], "supportRequest": "件名：CVE-2024-8927（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.* のバージョンで 8.1.30 未満は影響を受けます。\n・PHP 8.2.* のバージョンで 8.2.24 未満は影響を受けます。\n・PHP 8.3.* のバージョンで 8.3.12 未満は影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.30未満。影響ありとして記載：8.2系のうち、8.2.24未満。影響ありとして記載：8.3系のうち、8.3.12未満。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-8927", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:08:38.226Z", "lastSuccess": "2026-10-24T05:08:38.226Z", "sourceCheckedAt": "2026-10-24T05:08:38.226Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-8926", "aliases": [ "GHSA-p99j-rfp4-xqvq" ], "title": "PHP：コード実行", "summary": "PHP 8.1.*（8.1.30 未満）、8.2.*（8.2.24 未満）、8.3.*（8.3.12 未満）で、Windows のコードページを標準でない設定にすると、CVE-2024-4577 の修正を回避でき、Windows の「Best Fit」コードページの挙動を利用したコマンドインジェクションが可能になる。この脆弱性により、攻撃者は PHP バイナリにオプションを渡すことができ、スクリプトのソースコードを取得したり、サーバ上で任意の PHP コードを実行したりできる。", "risk": "攻撃者が PHP バイナリに不正なオプションを渡すことで、スクリプトのソースコードが漏洩したり、サーバ上で任意の PHP コードが実行されたりする可能性がある。", "product": "PHP", "category": "php", "component": "core", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.30（環境: Windows）" }, { "product": "PHP", "range": "8.2.* / < 8.2.24（環境: Windows）" }, { "product": "PHP", "range": "8.3.* / < 8.3.12（環境: Windows）" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。（環境: Windows）" } ], "fixed": [ "8.1.30", "8.2.24", "8.3.12" ], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8926", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-09-27T17:50:38.000Z", "modifiedAt": "2025-11-03T22:33:06.473Z", "fetchedAt": "2026-10-24T05:08:39.271Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows \"Best Fit\" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.", "sourceTitle": "PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "platforms": [ "Windows" ], "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.30", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.24", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.12", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: Windows。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-8926", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json", "fetchedAt": "2026-10-24T05:08:39.271Z", "publishedAt": "2024-10-08T03:48:53.628Z", "modifiedAt": "2025-11-03T22:33:06.473Z", "state": "published", "provider": "php", "title": "PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows \"Best Fit\" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "# PHP CGI Parameter Injection Vulnerability\r\n\r\nThis vulnerability is a bypass of CVE-2024-4577 when using a non-standard configuration of Windows codepages, only obtainable through the registry by pointing the ACP codepage to an OEM codepage. The required configuration is unlikely to occur in a real environment.\n\n#\n\n# PHP-CGI setup\n\n#\r\n\r\n SetHandler application/x-httpd-php-cgi\r\n\r\n\r\n Action application/x-httpd-php-cgi \"/php-cgi/php-cgi.exe\"\r\n\r\n\r\nPOST /?%a8-d%a8+allow_url_include%3d1+%a8-d%a8+auto_prepend_file%3dphp://input HTTP/1.1\r\nHost: {{host}}\r\nUser-Agent: curl/8.3.0\r\nAccept: */*\r\nContent-Length: 24\r\nContent-Type: application/x-www-form-urlencoded\r\nConnection: keep-alive\r\n\r\n \r\n```\n\n## Vulnerability principle:\r\nIn many code pages, Windows converts some wide characters to \", such as 0xa8 in 437 code page.\r\nWhen querystring is %a8-s%a8, Windows will first convert %a8 to \", and then remove the quotation marks before and after the command line parameters, that is, remove the quotation marks before and after -s.\r\nFinally, php-cgi.exe extracts only -s from argv, successfully bypassing the patch for CVE-2024-4577.\n\n## Affected scope:\r\nLatest version of PHP\r\n**Affected code page:**\r\n\"37\"=\"c_037.nls\" ;IBM EBCDIC* U.S./Canada\r\n\"1026\"=\"c_1026.nls\" ;IBM EBCDIC* Latin-5 Turkey\r\nC_1047.NLS\r\nC_1140.NLS\r\nC_1142.NLS\r\nC_1143.NLS\r\nC_1144.NLS\r\nC_1145.NLS\r\nC_1146.NLS\r\nC_1147.NLS\r\nC_1148.NLS\r\nC_1149.NLS\r\n\"20273\"=\"c_20273.nls\" ;IBM EBCDIC Germany\r\n\"20277\"=\"c_20277.nls\" ;IBM EBCDIC Denmark/Norway\r\n\"20278\"=\"c_20278.nls\" ;IBM EBCDIC Finland/Sweden\r\n\"20280\"=\"c_20280.nls\" ;IBM EBCDIC Italy\r\n\"20284\"=\"c_20284.nls\" ;IBM EBCDIC Latin America/Spain\r\n\"20285\"=\"c_20285.nls\" ;IBM EBCDIC United Kingdom\r\n\"20290\"=\"c_20290.nls\" ;IBM EBCDIC Japanese Katakana Extended\r\n\"20297\"=\"c_20297.nls\" ;IBM EBCDIC France\r\n\"20420\"=\"c_20420.nls\" ;IBM EBCDIC Arabic\r\n\"20423\"=\"c_20423.nls\" ;IBM EBCDIC Greek\r\nC_20424.NLS\r\n\"20833\"=\"c_20833.nls\" ;IBM EBCDIC Korean Extended\r\n\"20838\"=\"c_20838.nls\" ;IBM EBCDIC Thai\r\n\"20871\"=\"c_20871.nls\" ;IBM EBCDIC Icelandic\r\n\"20880\"=\"c_20880.nls\" ;IBM EBCDIC Cyrillic\r\n\"20905\"=\"c_20905.nls\" ;IBM EBCDIC Turkish\r\nC_20924.NLS\r\n\"21025\"=\"c_21025.nls\" ;IBM EBCDIC Cyrillic\r\n\"437\"=\"c_437.nls\" ;OEM* United States\r\n\"500\"=\"c_500.nls\" ;IBM EBCDIC* International\r\n\"860\"=\"c_860.nls\" ;OEM* Portuguese\r\n\"861\"=\"c_861.nls\" ;OEM* Icelandic\r\n\"862\"=\"c_862.nls\" ;OEM Hebrew\r\n\"865\"=\"c_865.nls\" ;OEM* Nordic\r\n\"870\"=\"c_870.nls\" ;IBM EBCDIC Latin-2 Multilingual/ROECE\r\n\"875\"=\"c_875.nls\" ;IBM EBCDIC Greece\r\n\r\n---\r\n\r\nI overlooked the difference between ANSI and OEM code pages in my initial analysis.\r\nWindows code pages are divided into ANSI and OEM code pages, where ANSI is used for GUI programs and OEM for console programs.\r\nThe previously mentioned affected code pages are all OEM code pages, while the xampp environment uses ANSI code pages for creating subprocesses.\r\n\r\nTherefore, changing the ACP field in the registry to 437 in the previous reproduction step is a configuration that is unlikely to occur in a real environment.\r\n\r\nBut this is still a potential security issue with php-cgi.exe: If a command line program like xampp uses php-cgi.exe in a similar form, problems may still occur. \r\nIn addition, there are actually some wide characters in the ANSI code page that can be converted to double quotes too, such as 0x2ba in the 1250 ANSI code page, but Apache limits our data range when expanding the input data to UTF-16. We can only look for wide characters that may be exploited in the range of 0x007f - 0x00ff, which makes 0x2ba unusable. Once other web servers break this limitation, php-cgi.exe may still have problems.\r\n\r\nFrom HuanGMz, s0duku, m4yfly from TianGong Team of Legendsec at Qi'anxin Group", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [ "Windows" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.30", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.24", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.12", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.30; patched versions: 8.1.30", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.24; patched versions: 8.2.24", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.12; patched versions: 8.3.12", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20241101-0003/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"platforms\":[\"Windows\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.30\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.24\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.12\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows \"Best Fit\" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-78\",\"description\":\"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-p99j-rfp4-xqvq:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq", "sourcePath": "/description", "text": "# PHP CGI Parameter Injection Vulnerability\r\n\r\nThis vulnerability is a bypass of CVE-2024-4577 when using a non-standard configuration of Windows codepages, only obtainable through the registry by pointing the ACP codepage to an OEM codepage. The required configuration is unlikely to occur in a real environment.\n\n#\n\n# PHP-CGI setup\n\n#\r\n\r\n SetHandler application/x-httpd-php-cgi\r\n\r\n\r\n Action application/x-httpd-php-cgi \"/php-cgi/php-cgi.exe\"\r\n\r\n\r\nPOST /?%a8-d%a8+allow_url_include%3d1+%a8-d%a8+auto_prepend_file%3dphp://input HTTP/1.1\r\nHost: {{host}}\r\nUser-Agent: curl/8.3.0\r\nAccept: */*\r\nContent-Length: 24\r\nContent-Type: application/x-www-form-urlencoded\r\nConnection: keep-alive\r\n\r\n \r\n```\n\n## Vulnerability principle:\r\nIn many code pages, Windows converts some wide characters to \", such as 0xa8 in 437 code page.\r\nWhen querystring is %a8-s%a8, Windows will first convert %a8 to \", and then remove the quotation marks before and after the command line parameters, that is, remove the quotation marks before and after -s.\r\nFinally, php-cgi.exe extracts only -s from argv, successfully bypassing the patch for CVE-2024-4577.\n\n## Affected scope:\r\nLatest version of PHP\r\n**Affected code page:**\r\n\"37\"=\"c_037.nls\" ;IBM EBCDIC* U.S./Canada\r\n\"1026\"=\"c_1026.nls\" ;IBM EBCDIC* Latin-5 Turkey\r\nC_1047.NLS\r\nC_1140.NLS\r\nC_1142.NLS\r\nC_1143.NLS\r\nC_1144.NLS\r\nC_1145.NLS\r\nC_1146.NLS\r\nC_1147.NLS\r\nC_1148.NLS\r\nC_1149.NLS\r\n\"20273\"=\"c_20273.nls\" ;IBM EBCDIC Germany\r\n\"20277\"=\"c_20277.nls\" ;IBM EBCDIC Denmark/Norway\r\n\"20278\"=\"c_20278.nls\" ;IBM EBCDIC Finland/Sweden\r\n\"20280\"=\"c_20280.nls\" ;IBM EBCDIC Italy\r\n\"20284\"=\"c_20284.nls\" ;IBM EBCDIC Latin America/Spain\r\n\"20285\"=\"c_20285.nls\" ;IBM EBCDIC United Kingdom\r\n\"20290\"=\"c_20290.nls\" ;IBM EBCDIC Japanese Katakana Extended\r\n\"20297\"=\"c_20297.nls\" ;IBM EBCDIC France\r\n\"20420\"=\"c_20420.nls\" ;IBM EBCDIC Arabic\r\n\"20423\"=\"c_20423.nls\" ;IBM EBCDIC Greek\r\nC_20424.NLS\r\n\"20833\"=\"c_20833.nls\" ;IBM EBCDIC Korean Extended\r\n\"20838\"=\"c_20838.nls\" ;IBM EBCDIC Thai\r\n\"20871\"=\"c_20871.nls\" ;IBM EBCDIC Icelandic\r\n\"20880\"=\"c_20880.nls\" ;IBM EBCDIC Cyrillic\r\n\"20905\"=\"c_20905.nls\" ;IBM EBCDIC Turkish\r\nC_20924.NLS\r\n\"21025\"=\"c_21025.nls\" ;IBM EBCDIC Cyrillic\r\n\"437\"=\"c_437.nls\" ;OEM* United States\r\n\"500\"=\"c_500.nls\" ;IBM EBCDIC* International\r\n\"860\"=\"c_860.nls\" ;OEM* Portuguese\r\n\"861\"=\"c_861.nls\" ;OEM* Icelandic\r\n\"862\"=\"c_862.nls\" ;OEM Hebrew\r\n\"865\"=\"c_865.nls\" ;OEM* Nordic\r\n\"870\"=\"c_870.nls\" ;IBM EBCDIC Latin-2 Multilingual/ROECE\r\n\"875\"=\"c_875.nls\" ;IBM EBCDIC Greece\r\n\r\n---\r\n\r\nI overlooked the difference between ANSI and OEM code pages in my initial analysis.\r\nWindows code pages are divided into ANSI and OEM code pages, where ANSI is used for GUI programs and OEM for console programs.\r\nThe previously mentioned affected code pages are all OEM code pages, while the xampp environment uses ANSI code pages for creating subprocesses.\r\n\r\nTherefore, changing the ACP field in the registry to 437 in the previous reproduction step is a configuration that is unlikely to occur in a real environment.\r\n\r\nBut this is still a potential security issue with php-cgi.exe: If a command line program like xampp uses php-cgi.exe in a similar form, problems may still occur. \r\nIn addition, there are actually some wide characters in the ANSI code page that can be converted to double quotes too, such as 0x2ba in the 1250 ANSI code page, but Apache limits our data range when expanding the input data to UTF-16. We can only look for wide characters that may be exploited in the range of 0x007f - 0x00ff, which makes 0x2ba unusable. Once other web servers break this limitation, php-cgi.exe may still have problems.\r\n\r\nFrom HuanGMz, s0duku, m4yfly from TianGong Team of Legendsec at Qi'anxin Group", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-p99j-rfp4-xqvq:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.30\",\"patched_versions\":\"8.1.30\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-p99j-rfp4-xqvq:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.24\",\"patched_versions\":\"8.2.24\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-p99j-rfp4-xqvq:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.12\",\"patched_versions\":\"8.3.12\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T22:33:06.473Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq", "modifiedAt": "2024-09-27T17:50:38.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T22:33:06.473Z", "fetchedAt": "2026-10-24T05:08:39.271Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2024-09-27T17:50:38.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:29:48.342Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "930fea9d2bab59a0c54fb2ba7d185ef3dcfb434a239af10f21177c31c075b82f", "sourceModifiedAt": "2025-11-03T22:33:06.473Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.30 未満）、8.2.*（8.2.24 未満）、8.3.*（8.3.12 未満）で、Windows のコードページを標準でない設定にすると、CVE-2024-4577 の修正を回避でき、Windows の「Best Fit」コードページの挙動を利用したコマンドインジェクションが可能になる。この脆弱性により、攻撃者は PHP バイナリにオプションを渡すことができ、スクリプトのソースコードを取得したり、サーバ上で任意の PHP コードを実行したりできる。", "risk": "攻撃者が PHP バイナリに不正なオプションを渡すことで、スクリプトのソースコードが漏洩したり、サーバ上で任意の PHP コードが実行されたりする可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Windows 上で動作する PHP 8.1.*（バージョン 8.1.30 未満）が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Windows 上で動作する PHP 8.2.*（バージョン 8.2.24 未満）が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Windows 上で動作する PHP 8.3.*（バージョン 8.3.12 未満）が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "影響は、Windows のコードページをレジストリで非標準の OEM コードページ（例: 437 など）に設定した場合にのみ発生し、実環境でその設定が行われる可能性は低い。", "kind": "fact", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.30未満。影響ありとして記載：8.2系のうち、8.2.24未満。影響ありとして記載：8.3系のうち、8.3.12未満。対象の環境：Windows。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-8926", "https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8926", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows \"Best Fit\" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json", "sourceField": "/containers/cna/title", "excerpt": "PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8926.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"platforms\":[\"Windows\"],\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.30\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.24\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.12\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-p99j-rfp4-xqvq", "sourceField": "/description", "excerpt": "# PHP CGI Parameter Injection Vulnerability\r\n\r\nThis vulnerability is a bypass of CVE-2024-4577 when using a non-standard configuration of Windows codepages, only obtainable through the registry by pointing the ACP codepage to an OEM codepage. The required configuration is unlikely to occur in a real environment.\n\n#\n\n# PHP-CGI setup\n\n#\r\n\r\n SetHandler application/x-httpd-php-cgi\r\n\r\n\r\n Action application/x-httpd-php-cgi \"/php-cgi/php-cgi.exe\"\r\n\r\n\r\nPOST /?%a8-d%a8+allow_url_include%3d1+%a8-d%a8+auto_prepend_file%3dphp://input HTTP/1.1\r\nHost: {{host}}\r\nUser-Agent: curl/8.3.0\r\nAccept: */*\r\nContent-Length: 24\r\nContent-Type: application/x-www-form-urlencoded\r\nConnection: keep-alive\r\n\r\n \r\n```\n\n## Vulnerability principle:\r\nIn many code pages, Windows converts some wide characters to \", such as 0xa8 in 437 code page.\r\nWhen querystring is %a8-s%a8, Windows will first convert %a8 to \", and then remove the quotation marks before and after the command line parameters, that is, remove the quotation marks before and after -s.\r\nFinally, php-cgi.exe extracts only -s from argv, successfully bypassing the patch for CVE-2024-4577.\n\n## Affected scope:\r\nLatest version of PHP\r\n**Affected code page:**\r\n\"37\"=\"c_037.nls\" ;IBM EBCDIC* U.S./Canada\r\n\"1026\"=\"c_1026.nls\" ;IBM EBCDIC* Latin-5 Turkey\r\nC_1047.NLS\r\nC_1140.NLS\r\nC_1142.NLS\r\nC_1143.NLS\r\nC_1144.NLS\r\nC_1145.NLS\r\nC_1146.NLS\r\nC_1147.NLS\r\nC_1148.NLS\r\nC_1149.NLS\r\n\"20273\"=\"c_20273.nls\" ;IBM EBCDIC Germany\r\n\"20277\"=\"c_20277.nls\" ;IBM EBCDIC Denmark/Norway\r\n\"20278\"=\"c_20278.nls\" ;IBM EBCDIC Finland/Sweden\r\n\"20280\"=\"c_20280.nls\" ;IBM EBCDIC Italy\r\n\"20284\"=\"c_20284.nls\" ;IBM EBCDIC Latin America/Spain\r\n\"20285\"=\"c_20285.nls\" ;IBM EBCDIC United Kingdom\r\n\"20290\"=\"c_20290.nls\" ;IBM EBCDIC Japanese Katakana Extended\r\n\"20297\"=\"c_20297.nls\" ;IBM EBCDIC France\r\n\"20420\"=\"c_20420.nls\" ;IBM EBCDIC Arabic\r\n\"20423\"=\"c_20423.nls\" ;IBM EBCDIC Greek\r\nC_20424.NLS\r\n\"20833\"=\"c_20833.nls\" ;IBM EBCDIC Korean Extended\r\n\"20838\"=\"c_20838.nls\" ;IBM EBCDIC Thai\r\n\"20871\"=\"c_20871.nls\" ;IBM EBCDIC Icelandic\r\n\"20880\"=\"c_20880.nls\" ;IBM EBCDIC Cyrillic\r\n\"20905\"=\"c_20905.nls\" ;IBM EBCDIC Turkish\r\nC_20924.NLS\r\n\"21025\"=\"c_21025.nls\" ;IBM EBCDIC Cyrillic\r\n\"437\"=\"c_437.nls\" ;OEM* United States\r\n\"500\"=\"c_500.nls\" ;IBM EBCDIC* International\r\n\"860\"=\"c_860.nls\" ;OEM* Portuguese\r\n\"861\"=\"c_861.nls\" ;OEM* Icelandic\r\n\"862\"=\"c_862.nls\" ;OEM Hebrew\r\n\"865\"=\"c_865.nls\" ;OEM* Nordic\r\n\"870\"=\"c_870.nls\" ;IBM EBCDIC Latin-2 Multilingual/ROECE\r\n\"875\"=\"c_875.nls\" ;IBM EBCDIC Greece\r\n\r\n---\r\n\r\nI overlooked the difference between ANSI and OEM code pages in my initial analysis.\r\nWindows code pages are divided into ANSI and OEM code pages, where ANSI is used for GUI programs and OEM for console programs.\r\nThe previously mentioned affected code pages are all OEM code pages, while the xampp environment uses ANSI code pages for creating subprocesses.\r\n\r\nTherefore, changing the ACP field in the registry to 437 in the previous reproduction step is a configuration that is unlikely to occur in a real environment.\r\n\r\nBut this is still a potential security issue with php-cgi.exe: If a command line program like xampp uses php-cgi.exe in a similar form, problems may still occur. \r\nIn addition, there are actually some wide characters in the ANSI code page that can be converted to double quotes too, such as 0x2ba in the 1250 ANSI code page, but Apache limits our data range when expanding the input data to UTF-16. We can only look for wide characters that may be exploited in the range of 0x007f - 0x00ff, which makes 0x2ba unusable. Once other web servers break this limitation, php-cgi.exe may still have problems.\r\n\r\nFrom HuanGMz, s0duku, m4yfly from TianGong Team of Legendsec at Qi'anxin Group", "language": "en", "representation": "defensive_sections", "filtered": true } ], "supportRequest": "件名：CVE-2024-8926（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Windows 上で動作する PHP 8.1.*（バージョン 8.1.30 未満）が影響を受ける。\n・Windows 上で動作する PHP 8.2.*（バージョン 8.2.24 未満）が影響を受ける。\n・Windows 上で動作する PHP 8.3.*（バージョン 8.3.12 未満）が影響を受ける。\n・影響は、Windows のコードページをレジストリで非標準の OEM コードページ（例: 437 など）に設定した場合にのみ発生し、実環境でその設定が行われる可能性は低い。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.30未満。影響ありとして記載：8.2系のうち、8.2.24未満。影響ありとして記載：8.3系のうち、8.3.12未満。対象の環境：Windows。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-8926", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:08:39.271Z", "lastSuccess": "2026-10-24T05:08:39.271Z", "sourceCheckedAt": "2026-10-24T05:08:39.271Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-8925", "aliases": [ "GHSA-9pqp-7h25-4f32" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1.*（8.1.30 未満）、8.2.*（8.2.24 未満）、8.3.*（8.3.12 未満）において、HTTP POST リクエストに含まれる multipart/form-data の解析が誤って行われると、正当なデータが処理されずに失われます。攻撃者が送信データの一部を操作できる場合、他の正当なデータの一部を除外させ、アプリケーションが誤った動作をする可能性があります。", "risk": "正当なデータが処理されず、アプリケーションが誤った動作をする可能性がある。", "product": "PHP", "category": "php", "component": "core", "severity": "low", "cvss": 3.1, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.30" }, { "product": "PHP", "range": "8.2.* / < 8.2.24" }, { "product": "PHP", "range": "8.3.* / < 8.3.12" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.1.30", "8.2.24", "8.3.12" ], "steps": [ "PHP 8.1.30、8.2.24、8.3.12 にアップデートする", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8925", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-09-27T17:50:21.000Z", "modifiedAt": "2025-11-03T22:33:05.003Z", "fetchedAt": "2026-10-24T06:12:44.041Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.", "sourceTitle": "Erroneous parsing of multipart form data", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.30", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.24", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.12", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-8925", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json", "fetchedAt": "2026-10-24T06:12:44.041Z", "publishedAt": "2024-10-08T03:35:02.673Z", "modifiedAt": "2025-11-03T22:33:05.003Z", "state": "published", "provider": "php", "title": "Erroneous parsing of multipart form data", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\nErroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed thus, violating data integrity.\n\n### Details\r\n\r\nA bug was discovered in the parsing of multipart form data contents, affecting both file and input form data. If a multipart form data payload contains a valid prefix `X` of the defined boundary `B` such that `5Kib` < `|X|` < `|B|` < `8Kib`, the logic responsible for parsing and storing the multipart payload fails to correctly extract the contents between two boundaries. This results in a violation of data integrity. The issue lies in the partial match handling in the following function:\r\n\r\n\r\n\r\nThis is called by the following functions when the contents between two boundaries have to be extracted after parsing the MIME headers:\n\n# payload 1 - the string \"\\r\\n--e932\" is not included in the constructed data structure later\n\n# on submitted to a PHP script\r\nboundary = \"e932eddb2559cca708c5cb806f24abfb\r\ncontent_type = f\"multipart/form-data; boundary={boundary}\"\r\nmsg2 = f'--{boundary}\\r\\nContent-Disposition: form-data; name=\"koko\"\\r\\n\\r\\n' \\\r\n+ 'A'*(5068+44) + f'\\r\\n--e932\\n--{boundary}--' \r\npython\n\n# payload 1 - the payload \"\\r\\n--{boundary[:len(boundary)-5]}' + 'C'*100 \" is again not included\n\n# in the constructed data structure later on submitted to a PHP script\r\n\r\nboundary = 'A'*(6*1024)\r\ncontent_type = f\"multipart/form-data; boundary={boundary}\"\r\nbody = f'--{boundary}\\r\\n' + 'Content-Disposition: form-data; name=\"koko\"\\r\\n\\r\\n' \\\r\n+ f'BBB\\r\\n--{boundary[:len(boundary)-5]}' + 'C'*100 + f\"\\r\\n--{boundary}--\"\r\n\r\nphp\r\n$name = $_POST['koko']; \r\n$file_path = '/tmp/parsing-bug.txt';\r\n$file = fopen($file_path, 'w');\r\nif ($file) {\r\n fwrite($file, $name . PHP_EOL); \r\n fclose($file);\r\n echo 'The name has been successfully written to the file.';\r\n }\r\n\r\nbash\n\n# tr -cd 'C' < /tmp/parsing-bug.txt | wc -c\r\n0\r\n```\n\n### Impact\r\n\r\nThe parsing bug violates data integrity. In the context where an attacker is capable of inserting a maliciously crafted payload at a desired location alongside other legitimate user payloads and is under control of other request parts such as the boundary, they can exclude portions of the legitimate data.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9pqp-7h25-4f32" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.30", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.24", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.12", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.30; patched versions: 8.1.30", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9pqp-7h25-4f32" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.24; patched versions: 8.2.24", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9pqp-7h25-4f32" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.12; patched versions: 8.3.12", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9pqp-7h25-4f32" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.1, "baseSeverity": "LOW", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20241101-0003/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.30\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.24\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.12\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":3.1,\"baseSeverity\":\"LOW\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"LOW\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-9pqp-7h25-4f32:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9pqp-7h25-4f32", "sourcePath": "/description", "text": "### Summary\r\nErroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed thus, violating data integrity.\n\n### Details\r\n\r\nA bug was discovered in the parsing of multipart form data contents, affecting both file and input form data. If a multipart form data payload contains a valid prefix `X` of the defined boundary `B` such that `5Kib` < `|X|` < `|B|` < `8Kib`, the logic responsible for parsing and storing the multipart payload fails to correctly extract the contents between two boundaries. This results in a violation of data integrity. The issue lies in the partial match handling in the following function:\r\n\r\n\r\n\r\nThis is called by the following functions when the contents between two boundaries have to be extracted after parsing the MIME headers:\n\n# payload 1 - the string \"\\r\\n--e932\" is not included in the constructed data structure later\n\n# on submitted to a PHP script\r\nboundary = \"e932eddb2559cca708c5cb806f24abfb\r\ncontent_type = f\"multipart/form-data; boundary={boundary}\"\r\nmsg2 = f'--{boundary}\\r\\nContent-Disposition: form-data; name=\"koko\"\\r\\n\\r\\n' \\\r\n+ 'A'*(5068+44) + f'\\r\\n--e932\\n--{boundary}--' \r\npython\n\n# payload 1 - the payload \"\\r\\n--{boundary[:len(boundary)-5]}' + 'C'*100 \" is again not included\n\n# in the constructed data structure later on submitted to a PHP script\r\n\r\nboundary = 'A'*(6*1024)\r\ncontent_type = f\"multipart/form-data; boundary={boundary}\"\r\nbody = f'--{boundary}\\r\\n' + 'Content-Disposition: form-data; name=\"koko\"\\r\\n\\r\\n' \\\r\n+ f'BBB\\r\\n--{boundary[:len(boundary)-5]}' + 'C'*100 + f\"\\r\\n--{boundary}--\"\r\n\r\nphp\r\n$name = $_POST['koko']; \r\n$file_path = '/tmp/parsing-bug.txt';\r\n$file = fopen($file_path, 'w');\r\nif ($file) {\r\n fwrite($file, $name . PHP_EOL); \r\n fclose($file);\r\n echo 'The name has been successfully written to the file.';\r\n }\r\n\r\nbash\n\n# tr -cd 'C' < /tmp/parsing-bug.txt | wc -c\r\n0\r\n```\n\n### Impact\r\n\r\nThe parsing bug violates data integrity. In the context where an attacker is capable of inserting a maliciously crafted payload at a desired location alongside other legitimate user payloads and is under control of other request parts such as the boundary, they can exclude portions of the legitimate data.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-9pqp-7h25-4f32:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9pqp-7h25-4f32", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.30\",\"patched_versions\":\"8.1.30\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-9pqp-7h25-4f32:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9pqp-7h25-4f32", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.24\",\"patched_versions\":\"8.2.24\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-9pqp-7h25-4f32:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9pqp-7h25-4f32", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.12\",\"patched_versions\":\"8.3.12\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T22:33:05.003Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9pqp-7h25-4f32", "modifiedAt": "2024-09-27T17:50:21.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T22:33:05.003Z", "fetchedAt": "2026-10-24T06:12:44.041Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2024-09-27T17:50:21.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:39:54.474Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "94573df2d46c1e6e586b7f1c9cceca72a3dd94a9085ff4f1f04929c175339dec", "sourceModifiedAt": "2025-11-03T22:33:05.003Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.30 未満）、8.2.*（8.2.24 未満）、8.3.*（8.3.12 未満）において、HTTP POST リクエストに含まれる multipart/form-data の解析が誤って行われると、正当なデータが処理されずに失われます。攻撃者が送信データの一部を操作できる場合、他の正当なデータの一部を除外させ、アプリケーションが誤った動作をする可能性があります。", "risk": "正当なデータが処理されず、アプリケーションが誤った動作をする可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.1.*（バージョン < 8.1.30）", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.2.*（バージョン < 8.2.24）", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.3.*（バージョン < 8.3.12）", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.30未満。影響ありとして記載：8.2系のうち、8.2.24未満。影響ありとして記載：8.3系のうち、8.3.12未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP 8.1.30、8.2.24、8.3.12 にアップデートする", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-8925", "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8925", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json", "sourceField": "/containers/cna/title", "excerpt": "Erroneous parsing of multipart form data", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8925.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.30\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.24\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.12\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32", "sourceField": "/fixed", "excerpt": "[\"8.1.30\",\"8.2.24\",\"8.3.12\"]", "language": null } ], "supportRequest": "件名：CVE-2024-8925（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.1.*（バージョン < 8.1.30）\n・PHP 8.2.*（バージョン < 8.2.24）\n・PHP 8.3.*（バージョン < 8.3.12）\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.30未満。影響ありとして記載：8.2系のうち、8.2.24未満。影響ありとして記載：8.3系のうち、8.3.12未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-8925", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:12:44.041Z", "lastSuccess": "2026-10-24T06:12:44.041Z", "sourceCheckedAt": "2026-10-24T06:12:44.041Z", "errorCode": null }, "glossary": [ { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" } ] } }, { "id": "CVE-2024-9026", "aliases": [ "GHSA-865w-9rf3-2wh5" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.1.*（8.1.30 未満）、8.2.*（8.2.24 未満）、8.3.*（8.3.12 未満）で、PHP‑FPM を使用し、設定で catch_workers_output を yes にしている場合、ログメッセージの内容を操作することで最終ログに最大 4 文字まで不正な文字列を混入させたり、最大 4 文字まで削除したりできる可能性があります。また、PHP‑FPM が syslog 出力を使用するように設定されている場合、同じ脆弱性を利用してさらに多くの文字をログから除去できる可能性があります。", "risk": "影響は低く、PHP‑FPM がワーカーの stdout／stderr をマスタープロセスにリダイレクトしている環境で、メッセージ長さを制御できる場合、ログに不正な文字列が混入したり、最大 4 文字が削除されたりします。syslog が設定されていて null バイトを注入できる場合、ログの残りの部分が送信されない可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "low", "cvss": 3.3, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "PHP", "range": "8.1.* / < 8.1.30" }, { "product": "PHP", "range": "8.2.* / < 8.2.24" }, { "product": "PHP", "range": "8.3.* / < 8.3.12" } ], "fixed": [ "8.1.30", "8.2.24", "8.3.12" ], "steps": [ "PHP 8.1.30、8.2.24、8.3.12 にアップデートして修正を適用してください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-9026", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2024-09-27T17:50:07.000Z", "modifiedAt": "2025-11-03T22:33:15.254Z", "fetchedAt": "2026-10-24T05:08:39.597Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.", "sourceTitle": "PHP-FPM logs from children may be altered", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.30", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.24", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.12", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-9026", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "fetchedAt": "2026-10-24T05:08:39.597Z", "publishedAt": "2024-10-08T04:07:33.452Z", "modifiedAt": "2025-11-03T22:33:15.254Z", "state": "published", "provider": "php", "title": "PHP-FPM logs from children may be altered", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\nIn PHP-FPM, when configured to catch workers output through `catch_workers_output = yes` configuration, it may be possible to pollute the final log with up to 4 characters from the `FPM_STDIO_CMD_FLUSH` macro, or remove up to 4 characters from the logs. Additionally, If PHP-FPM is configured to use a syslog, it seems that much more characters can be excluded from the logs, even though it has not been tested.\r\n\r\nNote that this issue was found and reported as part of Quarkslab security audit on PHP-SRC with the OSTIF and PHP Foundation.\n\n### Details\r\n\r\nThe method `static void fpm_stdio_child_said` defined in `sapi/fpm/fpm/fpm_stdio.c` is responsible for parsing and writing the logs out from workers input.\r\n\r\nThe interesting part is the following : \r\n\r\n\r\nFor each characters of `buf`, it is checked whether it is `\\n` or `\\0`. `\\n` is used to indicate that the current line of log is terminated and can be written. `\\0` is used to detect the `FPM_STDIO_CMD_FLUSH` macro characters sequence, defined as `\\0fscf\\0` and used to flush logs. It acts the same as `\\n`.\r\n\r\nIf a `\\0` character is encountered, and if the end of the buffer is reached before the full comparison with `FPM_STDIO_CMD_FLUSH` can be achieved, then the comparison is done with what is currently available: \r\n\r\n\r\n\r\nIf it matches, the number of characters that have already been checked is saved in `cmd_pos` and a `goto` statement bring the control flow back to the top of the loop so that the buffer can be filled again. After that, the comparison continues :\r\n\r\n\r\n\r\nAs `cmd_pos` is superior to 0, the comparison continues with the remaining characters to compare with. If it matches, the current buffer is written and flushed. The cursor is set to `cmd_pos` and the iteration on the buffer starts again. \r\nHowever, as is, the rest of the `FPM_STDIO_CMD_FLUSH` characters sequence is added to the next output, including the `\\0` character, or, the first bytes of the next outputs are not included depending of the value of `cmd_pos`.\r\n\r\nThat is because `start` shouldn't be set to `cmd_pos` value, which correspond to the number of characters that have already been compared, from the previous buffer. It should be set to `sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos` instead.\r\n\r\nAdditionnally and more generally, if a null character is contained in the log and a syslog is configured, it appears that the final string to be written won't contains the characters after this null character. Indeed, logs are sent by calling `php_syslog(syslog_priorities[zlog_level], \"%s\", stream->buf.data);` from `zlog_stream_buf_append` defined as :\r\n\r\nIt seams pretty obvious that a null character will be treated as the end of the buffer regarding the following line : `\t\tzlog_stream_buf_copy_char(stream, '\\0');` which is called right before`php_syslog` is, and that the buffer data is passed as a parameter without any information on its length.\r\n\r\nI anyway checked how the buffer was formatted and sent to the syslog server. The buffer and arguments are processed by `xbuf_format_converter` function defined in `/main/spprintf.c`, where, as expected, the length of the argument is determined using `strlen` function, which will stops on `\\0` :\r\n\r\n\r\n\r\nNote that some prerequisites may be needed in order to exploit this vulnerability from the outside world. Auditing the communications between PHP-FPM Master and its workers was one of the asked key tasks regarding Quarkslab audit.\n\n### Impact\r\nThe impact is low.\r\nUsers of PHP-FPM that redirect `stdout` and `stderr` of the workers towards the master process are be affected. If the length of the messages can be controlled, logs can be polluted by including part of `FPM_STDIO_CMD_FLUSH`, or stripped from up to 4 characters. \r\nIf a SYSLOG is configured and a null character can be injected in the messages sent by the workers, it seems that the rest of the log is not sent.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.1.*", "lessThan": "8.1.30", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.2.*", "lessThan": "8.2.24", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.3.*", "lessThan": "8.3.12", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.30; patched versions: 8.1.30", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.24; patched versions: 8.2.24", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.12; patched versions: 8.3.12", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-158", "lang": "en", "description": "CWE-158: Improper Neutralization of Null Byte or NUL Character", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-117", "lang": "en", "description": "CWE-117: Improper Output Neutralization for Logs", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.3, "baseSeverity": "LOW", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://security.netapp.com/advisory/ntap-20241101-0003/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.30\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.24\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.12\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-158\",\"description\":\"CWE-158: Improper Neutralization of Null Byte or NUL Character\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-117\",\"description\":\"CWE-117: Improper Output Neutralization for Logs\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"LOCAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"LOW\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-865w-9rf3-2wh5:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5", "sourcePath": "/description", "text": "### Summary\r\nIn PHP-FPM, when configured to catch workers output through `catch_workers_output = yes` configuration, it may be possible to pollute the final log with up to 4 characters from the `FPM_STDIO_CMD_FLUSH` macro, or remove up to 4 characters from the logs. Additionally, If PHP-FPM is configured to use a syslog, it seems that much more characters can be excluded from the logs, even though it has not been tested.\r\n\r\nNote that this issue was found and reported as part of Quarkslab security audit on PHP-SRC with the OSTIF and PHP Foundation.\n\n### Details\r\n\r\nThe method `static void fpm_stdio_child_said` defined in `sapi/fpm/fpm/fpm_stdio.c` is responsible for parsing and writing the logs out from workers input.\r\n\r\nThe interesting part is the following : \r\n\r\n\r\nFor each characters of `buf`, it is checked whether it is `\\n` or `\\0`. `\\n` is used to indicate that the current line of log is terminated and can be written. `\\0` is used to detect the `FPM_STDIO_CMD_FLUSH` macro characters sequence, defined as `\\0fscf\\0` and used to flush logs. It acts the same as `\\n`.\r\n\r\nIf a `\\0` character is encountered, and if the end of the buffer is reached before the full comparison with `FPM_STDIO_CMD_FLUSH` can be achieved, then the comparison is done with what is currently available: \r\n\r\n\r\n\r\nIf it matches, the number of characters that have already been checked is saved in `cmd_pos` and a `goto` statement bring the control flow back to the top of the loop so that the buffer can be filled again. After that, the comparison continues :\r\n\r\n\r\n\r\nAs `cmd_pos` is superior to 0, the comparison continues with the remaining characters to compare with. If it matches, the current buffer is written and flushed. The cursor is set to `cmd_pos` and the iteration on the buffer starts again. \r\nHowever, as is, the rest of the `FPM_STDIO_CMD_FLUSH` characters sequence is added to the next output, including the `\\0` character, or, the first bytes of the next outputs are not included depending of the value of `cmd_pos`.\r\n\r\nThat is because `start` shouldn't be set to `cmd_pos` value, which correspond to the number of characters that have already been compared, from the previous buffer. It should be set to `sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos` instead.\r\n\r\nAdditionnally and more generally, if a null character is contained in the log and a syslog is configured, it appears that the final string to be written won't contains the characters after this null character. Indeed, logs are sent by calling `php_syslog(syslog_priorities[zlog_level], \"%s\", stream->buf.data);` from `zlog_stream_buf_append` defined as :\r\n\r\nIt seams pretty obvious that a null character will be treated as the end of the buffer regarding the following line : `\t\tzlog_stream_buf_copy_char(stream, '\\0');` which is called right before`php_syslog` is, and that the buffer data is passed as a parameter without any information on its length.\r\n\r\nI anyway checked how the buffer was formatted and sent to the syslog server. The buffer and arguments are processed by `xbuf_format_converter` function defined in `/main/spprintf.c`, where, as expected, the length of the argument is determined using `strlen` function, which will stops on `\\0` :\r\n\r\n\r\n\r\nNote that some prerequisites may be needed in order to exploit this vulnerability from the outside world. Auditing the communications between PHP-FPM Master and its workers was one of the asked key tasks regarding Quarkslab audit.\n\n### Impact\r\nThe impact is low.\r\nUsers of PHP-FPM that redirect `stdout` and `stderr` of the workers towards the master process are be affected. If the length of the messages can be controlled, logs can be polluted by including part of `FPM_STDIO_CMD_FLUSH`, or stripped from up to 4 characters. \r\nIf a SYSLOG is configured and a null character can be injected in the messages sent by the workers, it seems that the rest of the log is not sent.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-865w-9rf3-2wh5:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.30\",\"patched_versions\":\"8.1.30\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-865w-9rf3-2wh5:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.24\",\"patched_versions\":\"8.2.24\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-865w-9rf3-2wh5:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.3.12\",\"patched_versions\":\"8.3.12\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2025-11-03T22:33:15.254Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5", "modifiedAt": "2024-09-27T17:50:08.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T22:33:15.254Z", "fetchedAt": "2026-10-24T05:08:39.597Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2024-09-27T17:50:08.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:29:49.349Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7c2be32a30b04cb5b76cb8592d236b91b3bc930f3277b0de926cf482a1d2f6eb", "sourceModifiedAt": "2025-11-03T22:33:15.254Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.1.*（8.1.30 未満）、8.2.*（8.2.24 未満）、8.3.*（8.3.12 未満）で、PHP‑FPM を使用し、設定で catch_workers_output を yes にしている場合、ログメッセージの内容を操作することで最終ログに最大 4 文字まで不正な文字列を混入させたり、最大 4 文字まで削除したりできる可能性があります。また、PHP‑FPM が syslog 出力を使用するように設定されている場合、同じ脆弱性を利用してさらに多くの文字をログから除去できる可能性があります。", "risk": "影響は低く、PHP‑FPM がワーカーの stdout／stderr をマスタープロセスにリダイレクトしている環境で、メッセージ長さを制御できる場合、ログに不正な文字列が混入したり、最大 4 文字が削除されたりします。syslog が設定されていて null バイトを注入できる場合、ログの残りの部分が送信されない可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "対象バージョンは PHP 8.1.*（8.1.30 未満）、8.2.*（8.2.24 未満）、8.3.*（8.3.12 未満）です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "PHP‑FPM SAPI を使用し、設定項目 catch_workers_output を yes にしている、または syslog 出力を使用している環境が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.30未満。影響ありとして記載：8.2系のうち、8.2.24未満。影響ありとして記載：8.3系のうち、8.3.12未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP 8.1.30、8.2.24、8.3.12 にアップデートして修正を適用してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5" ], "evidenceIds": [ "E5" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-9026", "https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-9026", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "sourceField": "/containers/cna/title", "excerpt": "PHP-FPM logs from children may be altered", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-865w-9rf3-2wh5", "sourceField": "/description", "excerpt": "### Summary\r\nIn PHP-FPM, when configured to catch workers output through `catch_workers_output = yes` configuration, it may be possible to pollute the final log with up to 4 characters from the `FPM_STDIO_CMD_FLUSH` macro, or remove up to 4 characters from the logs. Additionally, If PHP-FPM is configured to use a syslog, it seems that much more characters can be excluded from the logs, even though it has not been tested.\r\n\r\nNote that this issue was found and reported as part of Quarkslab security audit on PHP-SRC with the OSTIF and PHP Foundation.\n\n### Details\r\n\r\nThe method `static void fpm_stdio_child_said` defined in `sapi/fpm/fpm/fpm_stdio.c` is responsible for parsing and writing the logs out from workers input.\r\n\r\nThe interesting part is the following : \r\n\r\n\r\nFor each characters of `buf`, it is checked whether it is `\\n` or `\\0`. `\\n` is used to indicate that the current line of log is terminated and can be written. `\\0` is used to detect the `FPM_STDIO_CMD_FLUSH` macro characters sequence, defined as `\\0fscf\\0` and used to flush logs. It acts the same as `\\n`.\r\n\r\nIf a `\\0` character is encountered, and if the end of the buffer is reached before the full comparison with `FPM_STDIO_CMD_FLUSH` can be achieved, then the comparison is done with what is currently available: \r\n\r\n\r\n\r\nIf it matches, the number of characters that have already been checked is saved in `cmd_pos` and a `goto` statement bring the control flow back to the top of the loop so that the buffer can be filled again. After that, the comparison continues :\r\n\r\n\r\n\r\nAs `cmd_pos` is superior to 0, the comparison continues with the remaining characters to compare with. If it matches, the current buffer is written and flushed. The cursor is set to `cmd_pos` and the iteration on the buffer starts again. \r\nHowever, as is, the rest of the `FPM_STDIO_CMD_FLUSH` characters sequence is added to the next output, including the `\\0` character, or, the first bytes of the next outputs are not included depending of the value of `cmd_pos`.\r\n\r\nThat is because `start` shouldn't be set to `cmd_pos` value, which correspond to the number of characters that have already been compared, from the previous buffer. It should be set to `sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos` instead.\r\n\r\nAdditionnally and more generally, if a null character is contained in the log and a syslog is configured, it appears that the final string to be written won't contains the characters after this null character. Indeed, logs are sent by calling `php_syslog(syslog_priorities[zlog_level], \"%s\", stream->buf.data);` from `zlog_stream_buf_append` defined as :\r\n\r\nIt seams pretty obvious that a null character will be treated as the end of the buffer regarding the following line : `\t\tzlog_stream_buf_copy_char(stream, '\\0');` which is called right before`php_syslog` is, and that the buffer data is passed as a parameter without any information on its length.\r\n\r\nI anyway checked how the buffer was formatted and sent to the syslog server. The buffer and arguments are processed by `xbuf_format_converter` function defined in `/main/spprintf.c`, where, as expected, the length of the argument is determined using `strlen` function, which will stops on `\\0` :\r\n\r\n\r\n\r\nNote that some prerequisites may be needed in order to exploit this vulnerability from the outside world. Auditing the communications between PHP-FPM Master and its workers was one of the asked key tasks regarding Quarkslab audit.\n\n### Impact\r\nThe impact is low.\r\nUsers of PHP-FPM that redirect `stdout` and `stderr` of the workers towards the master process are be affected. If the length of the messages can be controlled, logs can be polluted by including part of `FPM_STDIO_CMD_FLUSH`, or stripped from up to 4 characters. \r\nIf a SYSLOG is configured and a null character can be injected in the messages sent by the workers, it seems that the rest of the log is not sent.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9026.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.1.30\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.24\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.3.12\",\"status\":\"affected\",\"version\":\"8.3.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5", "sourceField": "/fixed", "excerpt": "[\"8.1.30\",\"8.2.24\",\"8.3.12\"]", "language": null } ], "supportRequest": "件名：CVE-2024-9026（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象バージョンは PHP 8.1.*（8.1.30 未満）、8.2.*（8.2.24 未満）、8.3.*（8.3.12 未満）です。\n・PHP‑FPM SAPI を使用し、設定項目 catch_workers_output を yes にしている、または syslog 出力を使用している環境が対象です。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.1系のうち、8.1.30未満。影響ありとして記載：8.2系のうち、8.2.24未満。影響ありとして記載：8.3系のうち、8.3.12未満。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-9026", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:08:39.597Z", "lastSuccess": "2026-10-24T05:08:39.597Z", "sourceCheckedAt": "2026-10-24T05:08:39.597Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-7593", "aliases": [], "title": "vTM：脆弱性情報", "summary": "Ivanti vTM の認証アルゴリズムが不適切に実装されており、バージョン 22.2R1 および 22.7R2 以外では、リモートの認証されていない攻撃者が管理者パネルの認証を回避できる。", "risk": "攻撃者は認証を回避し、任意の管理者アカウントを作成できるため、管理者権限でシステムを操作できるようになる。", "product": "vTM", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "ivanti", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "vTM", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "「CVE-2024-7593」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json", "label": "CVE：ivanti" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-7593", "label": "CVE公式レコード" }, { "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7593", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-08-13T18:17:47.248Z", "modifiedAt": "2025-10-21T22:55:47.493Z", "fetchedAt": "2026-10-24T05:08:40.671Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "vTM", "vendor": "Ivanti", "versions": [ { "status": "unaffected", "version": "22.7R2", "versionType": "custom" }, { "status": "unaffected", "version": "22.2R1", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-7593", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json", "fetchedAt": "2026-10-24T05:08:40.671Z", "publishedAt": "2024-08-13T18:17:47.248Z", "modifiedAt": "2025-10-21T22:55:47.493Z", "state": "published", "provider": "ivanti", "title": "", "descriptions": [ { "lang": "en", "value": "Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Ivanti", "product": "vTM", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "22.7R2", "versionType": "custom", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "22.2R1", "versionType": "custom", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-303", "lang": "en", "description": "CWE-303 Incorrect Implementation of Authentication Algorithm", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "ivanti", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593", "label": "ivanti", "tags": [], "provider": "ivanti", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"vTM\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"22.7R2\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"22.2R1\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-287\",\"description\":\"CWE-287 Improper Authentication\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-303\",\"description\":\"CWE-303 Incorrect Implementation of Authentication Algorithm\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-7593:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "sourcePath": "retained:/originalText", "text": "Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-7593:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "modifiedAt": "2024-09-24T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:47.493Z", "fetchedAt": "2026-10-24T05:08:40.671Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-24T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "vTMに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:08:40.671Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "78079a41c2b8ff936509121041225dc0262e43c162edbb2af208cb1ac127e3e6", "sourceModifiedAt": "2025-10-21T22:55:47.493Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Ivanti vTM の認証アルゴリズムが不適切に実装されており、バージョン 22.2R1 および 22.7R2 以外では、リモートの認証されていない攻撃者が管理者パネルの認証を回避できる。", "risk": "攻撃者は認証を回避し、任意の管理者アカウントを作成できるため、管理者権限でシステムを操作できるようになる。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "リモートの認証されていない攻撃者が対象で、対象バージョンは 22.2R1 および 22.7R2 以外の Ivanti vTM すべて。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Ivanti / vTM。影響なしとして記載：22.7R2。影響なしとして記載：22.2R1。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json" ], "evidenceIds": [ "E3" ] }, { "text": "「vTM」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-7593", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "https://nvd.nist.gov/vuln/detail/CVE-2024-7593" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2024-7593」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-7593", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "https://nvd.nist.gov/vuln/detail/CVE-2024-7593" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-7593", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "https://nvd.nist.gov/vuln/detail/CVE-2024-7593" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-7593", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "https://nvd.nist.gov/vuln/detail/CVE-2024-7593" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-7593", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "https://nvd.nist.gov/vuln/detail/CVE-2024-7593" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json", "label": "CVE：ivanti" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-7593", "label": "CVE公式レコード" }, { "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7593", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "sourceField": "retained:/originalText", "excerpt": "Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7593.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"vTM\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"22.7R2\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"22.2R1\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-7593\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-7593（vTM）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの認証されていない攻撃者が対象で、対象バージョンは 22.2R1 および 22.7R2 以外の Ivanti vTM すべて。\n・公式の対象表：Ivanti / vTM。影響なしとして記載：22.7R2。影響なしとして記載：22.2R1。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-7593", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:08:40.671Z", "lastSuccess": "2026-10-24T05:08:40.671Z", "sourceCheckedAt": "2026-10-24T05:08:40.671Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-8963", "aliases": [], "title": "CSA (Cloud Services Appliance)：ファイルへの不正アクセス", "summary": "Ivanti Cloud Services Appliance (CSA) の 4.6 Patch 519 より前のバージョンにおけるパストラバーサル脆弱性により、リモートの認証されていない攻撃者が制限された機能にアクセスできる。", "risk": "攻撃者が制限された機能にアクセスでき、さらに CVE-2024-8190 と組み合わせると管理者認証を回避して任意のコマンドを実行できる可能性がある。", "product": "CSA (Cloud Services Appliance)", "category": "other", "component": "package", "severity": "critical", "cvss": 9.4, "cvssVersion": "3.1", "cvssSource": "ivanti", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "affected": [ { "product": "CSA (Cloud Services Appliance)", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "Ivanti CSA が End‑of‑Life となっているため、4.6 系統をサービスから除去するか、サポートされている 5.0 系統へアップグレードすることが推奨される。", "「CVE-2024-8963」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json", "label": "CVE：ivanti" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8963", "label": "CVE公式レコード" }, { "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8963", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-09-19T17:14:49.386Z", "modifiedAt": "2025-10-21T22:55:44.119Z", "fetchedAt": "2026-10-24T05:10:53.904Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "CSA (Cloud Services Appliance)", "vendor": "Ivanti", "versions": [ { "status": "unaffected", "version": "4.6 Patch 519", "versionType": "custom" }, { "status": "unaffected", "version": "5.0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-8963", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json", "fetchedAt": "2026-10-24T05:10:53.904Z", "publishedAt": "2024-09-19T17:14:49.386Z", "modifiedAt": "2025-10-21T22:55:44.119Z", "state": "published", "provider": "ivanti", "title": "", "descriptions": [ { "lang": "en", "value": "Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Ivanti", "product": "CSA (Cloud Services Appliance)", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "4.6 Patch 519", "versionType": "custom", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "5.0", "versionType": "custom", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "baseScore": 9.4, "baseSeverity": "CRITICAL", "provider": "ivanti", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963", "label": "ivanti", "tags": [], "provider": "ivanti", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8963", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"CSA (Cloud Services Appliance)\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"4.6 Patch 519\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"5.0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-22\",\"description\":\"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"LOW\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-8963:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "sourcePath": "retained:/originalText", "text": "Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-8963:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "sourcePath": "retained:/sourceAction", "text": "As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "modifiedAt": "2024-09-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:44.119Z", "fetchedAt": "2026-10-24T05:10:53.904Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-19T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.", "sourceSummary": "CSA (Cloud Services Appliance)にファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:10:53.904Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "4b7cc3fccf9b7582c9a511464ad3c8291125b0d5a4f515679d3fb2d1f8eb8b84", "sourceModifiedAt": "2025-10-21T22:55:44.119Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Ivanti Cloud Services Appliance (CSA) の 4.6 Patch 519 より前のバージョンにおけるパストラバーサル脆弱性により、リモートの認証されていない攻撃者が制限された機能にアクセスできる。", "risk": "攻撃者が制限された機能にアクセスでき、さらに CVE-2024-8190 と組み合わせると管理者認証を回避して任意のコマンドを実行できる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "リモートの認証されていない攻撃者が対象。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json" ], "evidenceIds": [ "E1" ] }, { "text": "Ivanti CSA のバージョンが 4.6 Patch 519 より前であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json" ], "evidenceIds": [ "E1", "E3" ] }, { "text": "CVE-2024-8190 が同時に利用可能な場合、管理者認証を回避し任意のコマンドを実行できる。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Ivanti / CSA (Cloud Services Appliance)。影響なしとして記載：4.6 Patch 519。影響なしとして記載：5.0。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json" ], "evidenceIds": [ "E3" ] }, { "text": "「CSA (Cloud Services Appliance)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-8963", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "https://nvd.nist.gov/vuln/detail/CVE-2024-8963" ] } ], "actions": [ { "text": "Ivanti CSA が End‑of‑Life となっているため、4.6 系統をサービスから除去するか、サポートされている 5.0 系統へアップグレードすることが推奨される。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2024-8963」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-8963", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "https://nvd.nist.gov/vuln/detail/CVE-2024-8963" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-8963", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "https://nvd.nist.gov/vuln/detail/CVE-2024-8963" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-8963", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "https://nvd.nist.gov/vuln/detail/CVE-2024-8963" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-8963", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "https://nvd.nist.gov/vuln/detail/CVE-2024-8963" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json", "label": "CVE：ivanti" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8963", "label": "CVE公式レコード" }, { "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8963", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "sourceField": "retained:/originalText", "excerpt": "Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8963.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"CSA (Cloud Services Appliance)\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"4.6 Patch 519\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"5.0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "sourceField": "retained:/sourceAction", "excerpt": "As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "sourceField": "/sourceAction", "excerpt": "As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8963", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-8963\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-8963（CSA (Cloud Services Appliance)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートの認証されていない攻撃者が対象。\n・Ivanti CSA のバージョンが 4.6 Patch 519 より前であること。\n・CVE-2024-8190 が同時に利用可能な場合、管理者認証を回避し任意のコマンドを実行できる。\n・公式の対象表：Ivanti / CSA (Cloud Services Appliance)。影響なしとして記載：4.6 Patch 519。影響なしとして記載：5.0。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-8963", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:10:53.904Z", "lastSuccess": "2026-10-24T05:10:53.904Z", "sourceCheckedAt": "2026-10-24T05:10:53.904Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2020-0618", "aliases": [], "title": "Microsoft SQL Server / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) / Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) / Microsoft SQL S：コード実行", "summary": "Microsoft SQL Server Reporting Services がページ要求を誤って処理するため、リモートコード実行の脆弱性が存在します。", "risk": "認証された攻撃者がこの脆弱性を利用すると、Report Server のサービス アカウント権限でコードを実行できる可能性があります。", "product": "Microsoft SQL Server / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) / Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) / Microsoft SQL S", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "microsoft", "cvssVector": null, "affected": [ { "product": "Microsoft SQL Server", "range": "2012 for 32-bit Systems Service Pack 4 (QFE)" }, { "product": "Microsoft SQL Server", "range": "2012 for x64-based Systems Service Pack 4 (QFE)" }, { "product": "Microsoft SQL Server", "range": "2016 for x64-based Systems Service Pack 2 (CU)" }, { "product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)", "range": "unspecified" }, { "product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)", "range": "unspecified" }, { "product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)", "range": "unspecified" }, { "product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)", "range": "unspecified" }, { "product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)", "range": "unspecified" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-0618", "label": "CVE公式レコード" }, { "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0618", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0618", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2020-02-11T21:22:45.000Z", "modifiedAt": "2026-08-15T03:55:30.558Z", "fetchedAt": "2026-10-24T05:10:53.904Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Microsoft SQL Server", "vendor": "Microsoft", "versions": [ { "status": "affected", "version": "2012 for 32-bit Systems Service Pack 4 (QFE)" }, { "status": "affected", "version": "2012 for x64-based Systems Service Pack 4 (QFE)" }, { "status": "affected", "version": "2016 for x64-based Systems Service Pack 2 (CU)" } ] }, { "product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)", "vendor": "Microsoft", "versions": [ { "status": "affected", "version": "unspecified" } ] }, { "product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)", "vendor": "Microsoft", "versions": [ { "status": "affected", "version": "unspecified" } ] }, { "product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)", "vendor": "Microsoft", "versions": [ { "status": "affected", "version": "unspecified" } ] }, { "product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)", "vendor": "Microsoft", "versions": [ { "status": "affected", "version": "unspecified" } ] }, { "product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)", "vendor": "Microsoft", "versions": [ { "status": "affected", "version": "unspecified" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2020-0618", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "fetchedAt": "2026-10-24T05:10:53.904Z", "publishedAt": "2020-02-11T21:22:45.000Z", "modifiedAt": "2026-08-15T03:55:30.558Z", "state": "published", "provider": "microsoft", "title": "", "descriptions": [ { "lang": "en", "value": "A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft SQL Server", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "2012 for 32-bit Systems Service Pack 4 (QFE)", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "2012 for x64-based Systems Service Pack 4 (QFE)", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "2016 for x64-based Systems Service Pack 2 (CU)", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "unspecified", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "unspecified", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "unspecified", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "unspecified", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)", "sourcePath": "/containers/cna/affected/5", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "unspecified", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Remote Code Execution", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0618", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Microsoft SQL Server\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"2012 for 32-bit Systems Service Pack 4 (QFE)\"},{\"status\":\"affected\",\"version\":\"2012 for x64-based Systems Service Pack 4 (QFE)\"},{\"status\":\"affected\",\"version\":\"2016 for x64-based Systems Service Pack 2 (CU)\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"unspecified\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"product\":\"Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"unspecified\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"product\":\"Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"unspecified\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"product\":\"Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"unspecified\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"product\":\"Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"unspecified\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Remote Code Execution\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2020-0618:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "sourcePath": "retained:/originalText", "text": "Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2020-0618:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "modifiedAt": "2024-09-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-15T03:55:30.558Z", "fetchedAt": "2026-10-24T05:10:53.904Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Microsoft SQL Server / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) / Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) / Microsoft SQL Sにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:10:53.904Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "5cd8c5e2dfb4d9e5e47b25f1fcfa4da36c46441da2ea49c7e900bf099ac814f1", "sourceModifiedAt": "2026-08-15T03:55:30.558Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft SQL Server Reporting Services がページ要求を誤って処理するため、リモートコード実行の脆弱性が存在します。", "risk": "認証された攻撃者がこの脆弱性を利用すると、Report Server のサービス アカウント権限でコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Microsoft SQL Server 2012 for 32-bit Systems Service Pack 4 (QFE) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E3" ] }, { "text": "Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E3" ] }, { "text": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (CU) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E3" ] }, { "text": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E4" ] }, { "text": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E5" ] }, { "text": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E6" ] }, { "text": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618" ], "evidenceIds": [ "E9" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft SQL Server / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) / Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) / Microsoft SQL S」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-0618", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618", "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html", "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0618", "https://nvd.nist.gov/vuln/detail/CVE-2020-0618" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2020-0618", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618", "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html", "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0618", "https://nvd.nist.gov/vuln/detail/CVE-2020-0618" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-0618", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618", "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html", "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0618", "https://nvd.nist.gov/vuln/detail/CVE-2020-0618" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-0618", "label": "CVE公式レコード" }, { "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0618", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0618", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "sourceField": "retained:/originalText", "excerpt": "Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Microsoft SQL Server\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"2012 for 32-bit Systems Service Pack 4 (QFE)\"},{\"status\":\"affected\",\"version\":\"2012 for x64-based Systems Service Pack 4 (QFE)\"},{\"status\":\"affected\",\"version\":\"2016 for x64-based Systems Service Pack 2 (CU)\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"unspecified\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"product\":\"Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"unspecified\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"product\":\"Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"unspecified\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"product\":\"Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"unspecified\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/0xxx/CVE-2020-0618.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"product\":\"Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)\",\"vendor\":\"Microsoft\",\"versions\":[{\"status\":\"affected\",\"version\":\"unspecified\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0618", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2020-0618\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2020-0618（Microsoft SQL Server / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) / Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) / Microsoft SQL S）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Microsoft SQL Server 2012 for 32-bit Systems Service Pack 4 (QFE) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。\n・Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。\n・Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (CU) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。\n・Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。\n・Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。\n・Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。\n・Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) の Reporting Services が、認証された攻撃者によるページ要求の処理において影響を受けます。\n・公式の対象表：Microsoft / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)。影響ありとして記載：具体的な版番号の記載なし。\n・公式の対象表：Microsoft / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)。影響ありとして記載：具体的な版番号の記載なし。\n・公式の対象表：Microsoft / Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)。影響ありとして記載：具体的な版番号の記載なし。\n・公式の対象表：Microsoft / Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)。影響ありとして記載：具体的な版番号の記載なし。\n・公式の対象表：Microsoft / Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2020-0618", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:10:53.904Z", "lastSuccess": "2026-10-24T05:10:53.904Z", "sourceCheckedAt": "2026-10-24T05:10:53.904Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" }, { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2020-14644", "aliases": [], "title": "WebLogic Server：脆弱性情報", "summary": "Oracle Fusion Middleware の WebLogic Server（Core コンポーネント）において、IIOP や T3 経由でネットワークに接続できる認証されていない攻撃者が容易に悪用でき、サーバーを乗っ取られる脆弱性があります。", "risk": "攻撃が成功すると、Oracle WebLogic Server が攻撃者に乗っ取られます。", "product": "WebLogic Server", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "oracle", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "WebLogic Server", "range": "12.2.1.3.0" }, { "product": "WebLogic Server", "range": "12.2.1.4.0" }, { "product": "WebLogic Server", "range": "14.1.1.0.0" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2020-14644」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json", "label": "CVE：oracle" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-14644", "label": "CVE公式レコード" }, { "url": "https://www.oracle.com/security-alerts/cpujul2020.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14644", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2020-07-15T17:34:31.000Z", "modifiedAt": "2026-01-12T21:03:12.100Z", "fetchedAt": "2026-10-24T05:10:53.904Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "WebLogic Server", "vendor": "Oracle Corporation", "versions": [ { "status": "affected", "version": "12.2.1.3.0" }, { "status": "affected", "version": "12.2.1.4.0" }, { "status": "affected", "version": "14.1.1.0.0" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2020-14644", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json", "fetchedAt": "2026-10-24T05:10:53.904Z", "publishedAt": "2020-07-15T17:34:31.000Z", "modifiedAt": "2026-01-12T21:03:12.100Z", "state": "published", "provider": "oracle", "title": "", "descriptions": [ { "lang": "en", "value": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Oracle Corporation", "product": "WebLogic Server", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.2.1.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "12.2.1.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "14.1.1.0.0", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "oracle", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.oracle.com/security-alerts/cpujul2020.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14644", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"WebLogic Server\",\"vendor\":\"Oracle Corporation\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.2.1.3.0\"},{\"status\":\"affected\",\"version\":\"12.2.1.4.0\"},{\"status\":\"affected\",\"version\":\"14.1.1.0.0\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2020-14644:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "sourcePath": "retained:/originalText", "text": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2020-14644:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "modifiedAt": "2024-09-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-01-12T21:03:12.100Z", "fetchedAt": "2026-10-24T05:10:53.904Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "WebLogic Serverに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:10:53.904Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "0a08a2e091721035d2c601cc9a801da3575c224b05823d4886d41986a98a8a54", "sourceModifiedAt": "2026-01-12T21:03:12.100Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Oracle Fusion Middleware の WebLogic Server（Core コンポーネント）において、IIOP や T3 経由でネットワークに接続できる認証されていない攻撃者が容易に悪用でき、サーバーを乗っ取られる脆弱性があります。", "risk": "攻撃が成功すると、Oracle WebLogic Server が攻撃者に乗っ取られます。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されていない攻撃者がネットワーク経由で IIOP または T3 にアクセスできることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Oracle Corporation / WebLogic Server。影響ありとして記載：12.2.1.3.0。影響ありとして記載：12.2.1.4.0。影響ありとして記載：14.1.1.0.0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json" ], "evidenceIds": [ "E2" ] }, { "text": "「WebLogic Server」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-14644", "https://www.oracle.com/security-alerts/cpujul2020.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "https://nvd.nist.gov/vuln/detail/CVE-2020-14644" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644" ], "evidenceIds": [ "E3" ] }, { "text": "「CVE-2020-14644」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2020-14644", "https://www.oracle.com/security-alerts/cpujul2020.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "https://nvd.nist.gov/vuln/detail/CVE-2020-14644" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-14644", "https://www.oracle.com/security-alerts/cpujul2020.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "https://nvd.nist.gov/vuln/detail/CVE-2020-14644" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2020-14644", "https://www.oracle.com/security-alerts/cpujul2020.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "https://nvd.nist.gov/vuln/detail/CVE-2020-14644" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-14644", "https://www.oracle.com/security-alerts/cpujul2020.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "https://nvd.nist.gov/vuln/detail/CVE-2020-14644" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json", "label": "CVE：oracle" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-14644", "label": "CVE公式レコード" }, { "url": "https://www.oracle.com/security-alerts/cpujul2020.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14644", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14644.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"WebLogic Server\",\"vendor\":\"Oracle Corporation\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.2.1.3.0\"},{\"status\":\"affected\",\"version\":\"12.2.1.4.0\"},{\"status\":\"affected\",\"version\":\"14.1.1.0.0\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-14644", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2020-14644\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2020-14644（WebLogic Server）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者がネットワーク経由で IIOP または T3 にアクセスできることが前提です。\n・公式の対象表：Oracle Corporation / WebLogic Server。影響ありとして記載：12.2.1.3.0。影響ありとして記載：12.2.1.4.0。影響ありとして記載：14.1.1.0.0。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2020-14644", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:10:53.904Z", "lastSuccess": "2026-10-24T05:10:53.904Z", "sourceCheckedAt": "2026-10-24T05:10:53.904Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2022-21445", "aliases": [], "title": "Application Development Framework (ADF)：脆弱性情報", "summary": "Oracle Application Development Framework (ADF) の ADF Faces コンポーネントに脆弱性があり、ネットワーク経由で HTTP にアクセスできる認証なしの攻撃者が悪用すると、ADF を乗っ取られる可能性があります。", "risk": "この脆弱性が成功すると、Oracle Application Development Framework が攻撃者に乗っ取られます。", "product": "Application Development Framework (ADF)", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "oracle", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Application Development Framework (ADF)", "range": "12.2.1.3.0" }, { "product": "Application Development Framework (ADF)", "range": "12.2.1.4.0" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止する。", "「CVE-2022-21445」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json", "label": "CVE：oracle" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-21445", "label": "CVE公式レコード" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21445", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2022-04-19T20:37:33.000Z", "modifiedAt": "2025-10-21T23:15:41.379Z", "fetchedAt": "2026-10-24T05:10:53.904Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Application Development Framework (ADF)", "vendor": "Oracle Corporation", "versions": [ { "status": "affected", "version": "12.2.1.3.0" }, { "status": "affected", "version": "12.2.1.4.0" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2022-21445", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json", "fetchedAt": "2026-10-24T05:10:53.904Z", "publishedAt": "2022-04-19T20:37:33.000Z", "modifiedAt": "2025-10-21T23:15:41.379Z", "state": "published", "provider": "oracle", "title": "", "descriptions": [ { "lang": "en-US", "value": "Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Oracle Corporation", "product": "Application Development Framework (ADF)", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.2.1.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "12.2.1.4.0", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF).", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "oracle", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21445", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Application Development Framework (ADF)\",\"vendor\":\"Oracle Corporation\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.2.1.3.0\"},{\"status\":\"affected\",\"version\":\"12.2.1.4.0\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en-US\",\"description\":\"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF).\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2022-21445:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "sourcePath": "retained:/originalText", "text": "Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2022-21445:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "modifiedAt": "2024-09-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:15:41.379Z", "fetchedAt": "2026-10-24T05:10:53.904Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Application Development Framework (ADF)に脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:10:53.904Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "400fc20fdf5269c01335c769e1294bcaa85cb8cbd19f12b20069569e3d69cccf", "sourceModifiedAt": "2025-10-21T23:15:41.379Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Oracle Application Development Framework (ADF) の ADF Faces コンポーネントに脆弱性があり、ネットワーク経由で HTTP にアクセスできる認証なしの攻撃者が悪用すると、ADF を乗っ取られる可能性があります。", "risk": "この脆弱性が成功すると、Oracle Application Development Framework が攻撃者に乗っ取られます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "認証なしの攻撃者が HTTP 経由でネットワークにアクセスできること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "対象製品は Oracle Application Development Framework (ADF) の ADF Faces ライブラリであること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json" ], "evidenceIds": [ "E1" ] }, { "text": "影響を受けるバージョンは 12.2.1.3.0 および 12.2.1.4.0 であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json" ], "evidenceIds": [ "E3" ] }, { "text": "脆弱性は信頼できないデータの逆シリアライズに起因し、リモートコード実行が可能になること。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Oracle Corporation / Application Development Framework (ADF)。影響ありとして記載：12.2.1.3.0。影響ありとして記載：12.2.1.4.0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445" ], "evidenceIds": [ "E7" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Application Development Framework (ADF)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2022-21445", "https://www.oracle.com/security-alerts/cpuapr2022.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "https://nvd.nist.gov/vuln/detail/CVE-2022-21445" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445" ], "evidenceIds": [ "E5", "E6" ] }, { "text": "「CVE-2022-21445」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2022-21445", "https://www.oracle.com/security-alerts/cpuapr2022.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "https://nvd.nist.gov/vuln/detail/CVE-2022-21445" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2022-21445", "https://www.oracle.com/security-alerts/cpuapr2022.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "https://nvd.nist.gov/vuln/detail/CVE-2022-21445" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2022-21445", "https://www.oracle.com/security-alerts/cpuapr2022.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "https://nvd.nist.gov/vuln/detail/CVE-2022-21445" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2022-21445", "https://www.oracle.com/security-alerts/cpuapr2022.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "https://nvd.nist.gov/vuln/detail/CVE-2022-21445" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json", "label": "CVE：oracle" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-21445", "label": "CVE公式レコード" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21445", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en-US\",\"description\":\"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF).\",\"type\":\"text\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/21xxx/CVE-2022-21445.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Application Development Framework (ADF)\",\"vendor\":\"Oracle Corporation\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.2.1.3.0\"},{\"status\":\"affected\",\"version\":\"12.2.1.4.0\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "sourceField": "retained:/originalText", "excerpt": "Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.", "language": "en", "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "sourceField": "/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2022-21445\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2022-21445（Application Development Framework (ADF)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証なしの攻撃者が HTTP 経由でネットワークにアクセスできること。\n・対象製品は Oracle Application Development Framework (ADF) の ADF Faces ライブラリであること。\n・影響を受けるバージョンは 12.2.1.3.0 および 12.2.1.4.0 であること。\n・脆弱性は信頼できないデータの逆シリアライズに起因し、リモートコード実行が可能になること。\n・公式の対象表：Oracle Corporation / Application Development Framework (ADF)。影響ありとして記載：12.2.1.3.0。影響ありとして記載：12.2.1.4.0。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2022-21445", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:10:53.904Z", "lastSuccess": "2026-10-24T05:10:53.904Z", "sourceCheckedAt": "2026-10-24T05:10:53.904Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2024-27348", "aliases": [], "title": "Apache HugeGraph-Server：コード実行", "summary": "Apache HugeGraph-Server にリモートコマンド実行の脆弱性があり、攻撃者がサーバー上で任意のコマンドを実行できる可能性があります。この脆弱性は、Java8 または Java11 で動作する Apache HugeGraph-Server のバージョン 1.0.0 から 1.3.0 未満に影響します。", "risk": "リモート攻撃者が任意のコードを実行できる可能性があります。", "product": "Apache HugeGraph-Server", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apache", "cvssVector": null, "affected": [ { "product": "Apache HugeGraph-Server", "range": ">= 1.0.0 / < 1.3.0" } ], "fixed": [], "steps": [ "バージョン 1.3.0（Java11）にアップグレードし、認証システムを有効化することで本脆弱性を修正できます。", "「CVE-2024-27348」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json", "label": "CVE：apache" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-27348", "label": "CVE公式レコード" }, { "url": "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication", "label": "CVE掲載の参考情報" }, { "url": "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9", "label": "CISAが示す関連情報" }, { "url": "http://www.openwall.com/lists/oss-security/2024/04/22/3", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27348", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-04-22T14:08:06.294Z", "modifiedAt": "2025-10-21T23:05:21.096Z", "fetchedAt": "2026-10-24T05:11:10.260Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.", "sourceTitle": "Apache HugeGraph-Server: Command execution in gremlin", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Apache HugeGraph-Server", "vendor": "Apache Software Foundation", "versions": [ { "lessThan": "1.3.0", "status": "affected", "version": "1.0.0", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-27348", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json", "fetchedAt": "2026-10-24T05:11:10.260Z", "publishedAt": "2024-04-22T14:08:06.294Z", "modifiedAt": "2025-10-21T23:05:21.096Z", "state": "published", "provider": "apache", "title": "Apache HugeGraph-Server: Command execution in gremlin", "descriptions": [ { "lang": "en", "value": "RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache HugeGraph-Server", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "1.0.0", "lessThan": "1.3.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "RCE-Remote Command Execution", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication", "label": "CVE", "tags": [ "related", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9", "label": "CVE", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "http://www.openwall.com/lists/oss-security/2024/04/22/3", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27348", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Apache HugeGraph-Server\",\"vendor\":\"Apache Software Foundation\",\"versions\":[{\"lessThan\":\"1.3.0\",\"status\":\"affected\",\"version\":\"1.0.0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"RCE-Remote Command Execution\",\"lang\":\"en\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-27348:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "sourcePath": "retained:/originalText", "text": "Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-27348:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "modifiedAt": "2024-09-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:21.096Z", "fetchedAt": "2026-10-24T05:11:10.260Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-18T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Apache HugeGraph-Serverにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:11:10.260Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ce091674bca5b2c78b81494512234f8249be47893e3268ecc07317a1a8071a88", "sourceModifiedAt": "2025-10-21T23:05:21.096Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Apache HugeGraph-Server にリモートコマンド実行の脆弱性があり、攻撃者がサーバー上で任意のコマンドを実行できる可能性があります。この脆弱性は、Java8 または Java11 で動作する Apache HugeGraph-Server のバージョン 1.0.0 から 1.3.0 未満に影響します。", "risk": "リモート攻撃者が任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3", "E1" ], "applicability": [ { "text": "Apache HugeGraph-Server のバージョン 1.0.0 以上 1.3.0 未満、かつ Java8 または Java11 環境で動作している場合に本脆弱性の対象となります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：Apache Software Foundation / Apache HugeGraph-Server。影響ありとして記載：1.0.0以上、1.3.0未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json" ], "evidenceIds": [ "E4" ] }, { "text": "「Apache HugeGraph-Server」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-27348", "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication", "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9", "http://www.openwall.com/lists/oss-security/2024/04/22/3", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "https://nvd.nist.gov/vuln/detail/CVE-2024-27348" ] } ], "actions": [ { "text": "バージョン 1.3.0（Java11）にアップグレードし、認証システムを有効化することで本脆弱性を修正できます。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2024-27348」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-27348", "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication", "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9", "http://www.openwall.com/lists/oss-security/2024/04/22/3", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "https://nvd.nist.gov/vuln/detail/CVE-2024-27348" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-27348", "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication", "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9", "http://www.openwall.com/lists/oss-security/2024/04/22/3", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "https://nvd.nist.gov/vuln/detail/CVE-2024-27348" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-27348", "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication", "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9", "http://www.openwall.com/lists/oss-security/2024/04/22/3", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "https://nvd.nist.gov/vuln/detail/CVE-2024-27348" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-27348", "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication", "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9", "http://www.openwall.com/lists/oss-security/2024/04/22/3", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "https://nvd.nist.gov/vuln/detail/CVE-2024-27348" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json", "label": "CVE：apache" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-27348", "label": "CVE公式レコード" }, { "url": "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication", "label": "CVE掲載の参考情報" }, { "url": "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9", "label": "CISAが示す関連情報" }, { "url": "http://www.openwall.com/lists/oss-security/2024/04/22/3", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27348", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json", "sourceField": "/containers/cna/title", "excerpt": "Apache HugeGraph-Server: Command execution in gremlin", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "sourceField": "retained:/originalText", "excerpt": "Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27348.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Apache HugeGraph-Server\",\"vendor\":\"Apache Software Foundation\",\"versions\":[{\"lessThan\":\"1.3.0\",\"status\":\"affected\",\"version\":\"1.0.0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27348", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-27348\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-27348（Apache HugeGraph-Server）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Apache HugeGraph-Server のバージョン 1.0.0 以上 1.3.0 未満、かつ Java8 または Java11 環境で動作している場合に本脆弱性の対象となります。\n・公式の対象表：Apache Software Foundation / Apache HugeGraph-Server。影響ありとして記載：1.0.0以上、1.3.0未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-27348", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:11:10.260Z", "lastSuccess": "2026-10-24T05:11:10.260Z", "sourceCheckedAt": "2026-10-24T05:11:10.260Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2013-0643", "aliases": [], "title": "n/a：コード実行", "summary": "Adobe Flash Player の Firefox サンドボックスは、Windows と macOS ではバージョン 10.3.183.67 未満および 11 系列では 11.6.602.171 未満、Linux ではバージョン 10.3.183.67 未満および 11 系列では 11.2.202.273 未満の環境で特権の制限が適切に行われず、細工した SWF コンテンツを通じてリモート攻撃者が任意のコードを実行しやすくなり、2013 年 2 月に実際に悪用された。", "risk": "リモート攻撃者が任意のコードを実行できるため、攻撃対象のシステム上で攻撃者の指示が実行される可能性がある。", "product": "Adobe Flash Player", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "adobe", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "製品はサポートが終了しているため、利用を中止すること。", "「CVE-2013-0643」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2013-0643", "label": "CVE公式レコード" }, { "url": "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "label": "RHSA-2013:0574" }, { "url": "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "label": "CVE掲載の参考情報" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "label": "SUSE-SU-2013:0373" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "label": "openSUSE-SU-2013:0359" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "label": "openSUSE-SU-2013:0360" }, { "url": "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0643", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2013-02-27T00:00:00.000Z", "modifiedAt": "2025-10-22T00:05:43.876Z", "fetchedAt": "2026-10-24T05:11:14.331Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2013-0643", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json", "fetchedAt": "2026-10-24T05:11:14.331Z", "publishedAt": "2013-02-27T00:00:00.000Z", "modifiedAt": "2025-10-22T00:05:43.876Z", "state": "published", "provider": "adobe", "title": "", "descriptions": [ { "lang": "en", "value": "The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "label": "RHSA-2013:0574", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "label": "SUSE-SU-2013:0373", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "label": "openSUSE-SU-2013:0359", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "label": "openSUSE-SU-2013:0360", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0643", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2013-0643:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "sourcePath": "retained:/originalText", "text": "Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2013-0643:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "sourcePath": "retained:/sourceAction", "text": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "modifiedAt": "2024-09-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-22T00:05:43.876Z", "fetchedAt": "2026-10-24T05:11:14.331Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:11:14.331Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3dcb74e2dc35e000d595166bd89def51718f57f4c15300cdb547fd6b1a37ed67", "sourceModifiedAt": "2025-10-22T00:05:43.876Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Adobe Flash Player の Firefox サンドボックスは、Windows と macOS ではバージョン 10.3.183.67 未満および 11 系列では 11.6.602.171 未満、Linux ではバージョン 10.3.183.67 未満および 11 系列では 11.2.202.273 未満の環境で特権の制限が適切に行われず、細工した SWF コンテンツを通じてリモート攻撃者が任意のコードを実行しやすくなり、2013 年 2 月に実際に悪用された。", "risk": "リモート攻撃者が任意のコードを実行できるため、攻撃対象のシステム上で攻撃者の指示が実行される可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Windows および macOS 上の Adobe Flash Player で、Firefox 用サンドボックスがバージョン 10.3.183.67 未満（10 系列）または 11.6.602.171 未満（11 系列）である場合。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json" ], "evidenceIds": [ "E1" ] }, { "text": "Linux 上の Adobe Flash Player で、Firefox 用サンドボックスがバージョン 10.3.183.67 未満（10 系列）または 11.2.202.273 未満（11 系列）である場合。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Adobe Flash Player」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2013-0643", "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2013-0643" ] } ], "actions": [ { "text": "製品はサポートが終了しているため、利用を中止すること。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2013-0643」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2013-0643", "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2013-0643" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2013-0643", "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2013-0643" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2013-0643", "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2013-0643" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2013-0643", "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2013-0643" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2013-0643", "label": "CVE公式レコード" }, { "url": "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "label": "RHSA-2013:0574" }, { "url": "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "label": "CVE掲載の参考情報" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "label": "SUSE-SU-2013:0373" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "label": "openSUSE-SU-2013:0359" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "label": "openSUSE-SU-2013:0360" }, { "url": "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0643", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "sourceField": "retained:/originalText", "excerpt": "Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0643.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "sourceField": "retained:/sourceAction", "excerpt": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0643", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2013-0643\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2013-0643（Adobe Flash Player）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Windows および macOS 上の Adobe Flash Player で、Firefox 用サンドボックスがバージョン 10.3.183.67 未満（10 系列）または 11.6.602.171 未満（11 系列）である場合。\n・Linux 上の Adobe Flash Player で、Firefox 用サンドボックスがバージョン 10.3.183.67 未満（10 系列）または 11.2.202.273 未満（11 系列）である場合。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2013-0643", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:11:14.331Z", "lastSuccess": "2026-10-24T05:11:14.331Z", "sourceCheckedAt": "2026-10-24T05:11:14.331Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2013-0648", "aliases": [], "title": "n/a：コード実行", "summary": "Adobe Flash Player の ExternalInterface ActionScript 機能に未特定の脆弱性があり、Windows と Mac OS X ではバージョン 10.3.183.67 未満および 11 系では 11.6.602.171 未満、Linux ではバージョン 10.3.183.67 未満および 11 系では 11.2.202.273 未満の環境で、細工した SWF コンテンツを介してリモートの攻撃者が任意のコードを実行できる（2013 年 2 月に実際に悪用された）ことが報告されています。", "risk": "リモートの攻撃者が任意のコードを実行できるため、対象システムが完全に制御される危険があります。", "product": "Adobe Flash Player", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "adobe", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "対象製品は既にサポートが終了しているため、利用を中止してください。", "「CVE-2013-0648」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2013-0648", "label": "CVE公式レコード" }, { "url": "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "label": "RHSA-2013:0574" }, { "url": "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "label": "CVE掲載の参考情報" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "label": "SUSE-SU-2013:0373" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "label": "openSUSE-SU-2013:0359" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "label": "openSUSE-SU-2013:0360" }, { "url": "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0648", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2013-02-27T00:00:00.000Z", "modifiedAt": "2026-01-12T21:07:32.722Z", "fetchedAt": "2026-10-24T05:11:18.339Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2013-0648", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json", "fetchedAt": "2026-10-24T05:11:18.339Z", "publishedAt": "2013-02-27T00:00:00.000Z", "modifiedAt": "2026-01-12T21:07:32.722Z", "state": "published", "provider": "adobe", "title": "", "descriptions": [ { "lang": "en", "value": "Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "label": "RHSA-2013:0574", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "label": "SUSE-SU-2013:0373", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "label": "openSUSE-SU-2013:0359", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "label": "openSUSE-SU-2013:0360", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0648", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2013-0648:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "sourcePath": "retained:/originalText", "text": "Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2013-0648:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "sourcePath": "retained:/sourceAction", "text": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "modifiedAt": "2024-09-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-01-12T21:07:32.722Z", "fetchedAt": "2026-10-24T05:11:18.339Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:11:18.339Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a1fdd911d0625bbeaf74557bffede120c72378cc5b85dc5b926ee04bb0213fdd", "sourceModifiedAt": "2026-01-12T21:07:32.722Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Adobe Flash Player の ExternalInterface ActionScript 機能に未特定の脆弱性があり、Windows と Mac OS X ではバージョン 10.3.183.67 未満および 11 系では 11.6.602.171 未満、Linux ではバージョン 10.3.183.67 未満および 11 系では 11.2.202.273 未満の環境で、細工した SWF コンテンツを介してリモートの攻撃者が任意のコードを実行できる（2013 年 2 月に実際に悪用された）ことが報告されています。", "risk": "リモートの攻撃者が任意のコードを実行できるため、対象システムが完全に制御される危険があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "攻撃者はリモートから細工した SWF コンテンツを配布できる必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象は Windows または Mac OS X 上の Adobe Flash Player で、バージョンが 10.3.183.67 未満、または 11 系で 11.6.602.171 未満です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象は Linux 上の Adobe Flash Player で、バージョンが 10.3.183.67 未満、または 11 系で 11.2.202.273 未満です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json" ], "evidenceIds": [ "E1" ] }, { "text": "影響を受けるのは ExternalInterface ActionScript 機能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Adobe Flash Player」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2013-0648", "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2013-0648" ] } ], "actions": [ { "text": "対象製品は既にサポートが終了しているため、利用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2013-0648」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2013-0648", "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2013-0648" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2013-0648", "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2013-0648" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2013-0648", "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2013-0648" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2013-0648", "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2013-0648" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2013-0648", "label": "CVE公式レコード" }, { "url": "http://rhn.redhat.com/errata/RHSA-2013-0574.html", "label": "RHSA-2013:0574" }, { "url": "http://www.adobe.com/support/security/bulletins/apsb13-08.html", "label": "CVE掲載の参考情報" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html", "label": "SUSE-SU-2013:0373" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html", "label": "openSUSE-SU-2013:0359" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html", "label": "openSUSE-SU-2013:0360" }, { "url": "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0648", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "sourceField": "retained:/originalText", "excerpt": "Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2013/0xxx/CVE-2013-0648.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "sourceField": "retained:/sourceAction", "excerpt": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "sourceField": "/sourceAction", "excerpt": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2013-0648\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2013-0648（Adobe Flash Player）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者はリモートから細工した SWF コンテンツを配布できる必要があります。\n・対象は Windows または Mac OS X 上の Adobe Flash Player で、バージョンが 10.3.183.67 未満、または 11 系で 11.6.602.171 未満です。\n・対象は Linux 上の Adobe Flash Player で、バージョンが 10.3.183.67 未満、または 11 系で 11.2.202.273 未満です。\n・影響を受けるのは ExternalInterface ActionScript 機能です。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2013-0648", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:11:18.339Z", "lastSuccess": "2026-10-24T05:11:18.339Z", "sourceCheckedAt": "2026-10-24T05:11:18.339Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2014-0497", "aliases": [], "title": "n/a：コード実行", "summary": "Adobe Flash Player の Windows と Mac OS X では 11.7.700.261 未満、または 11.8 系から 12.0 系で 12.0.0.44 未満、Linux では 11.2.202.336 未満のバージョンに整数アンダーフローがあり、リモート攻撃者が未指定のベクトルを通じて任意のコードを実行できる可能性があります。", "risk": "リモート攻撃者が任意のコードを実行できる可能性があります。", "product": "Adobe Flash Player", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "adobe", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "影響を受ける製品はサポート終了またはサービス終了しているため、使用を中止すべきです。", "「CVE-2014-0497」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2014-0497", "label": "CVE公式レコード" }, { "url": "http://www.exploit-db.com/exploits/33212", "label": "33212" }, { "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-04.html", "label": "CVE掲載の参考情報" }, { "url": "http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html", "label": "CVE掲載の参考情報" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html", "label": "SUSE-SU-2014:0221" }, { "url": "http://rhn.redhat.com/errata/RHSA-2014-0137.html", "label": "RHSA-2014:0137" }, { "url": "http://www.osvdb.org/102849", "label": "102849" }, { "url": "http://www.securityfocus.com/bid/65327", "label": "65327" }, { "url": "http://secunia.com/advisories/56799", "label": "56799" }, { "url": "http://www.securitytracker.com/id/1029715", "label": "1029715" }, { "url": "http://secunia.com/advisories/56737", "label": "56737" }, { "url": "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0497", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2014-02-05T02:00:00.000Z", "modifiedAt": "2025-10-22T00:05:39.174Z", "fetchedAt": "2026-10-24T05:11:19.981Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2014-0497", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json", "fetchedAt": "2026-10-24T05:11:19.981Z", "publishedAt": "2014-02-05T02:00:00.000Z", "modifiedAt": "2025-10-22T00:05:39.174Z", "state": "published", "provider": "adobe", "title": "", "descriptions": [ { "lang": "en", "value": "Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://www.exploit-db.com/exploits/33212", "label": "33212", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-04.html", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html", "label": "SUSE-SU-2014:0221", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://rhn.redhat.com/errata/RHSA-2014-0137.html", "label": "RHSA-2014:0137", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://www.osvdb.org/102849", "label": "102849", "tags": [ "vdb-entry", "x_refsource_OSVDB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://www.securityfocus.com/bid/65327", "label": "65327", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://secunia.com/advisories/56799", "label": "56799", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "http://www.securitytracker.com/id/1029715", "label": "1029715", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "http://secunia.com/advisories/56737", "label": "56737", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "http://secunia.com/advisories/56437", "label": "56437", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00001.html", "label": "openSUSE-SU-2014:0203", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "http://secunia.com/advisories/56780", "label": "56780", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/12" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00000.html", "label": "openSUSE-SU-2014:0197", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/13" }, { "url": "http://secunia.com/advisories/56839", "label": "56839", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/14" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90884", "label": "adobe-flash-cve20140497-code-exec(90884)", "tags": [ "vdb-entry", "x_refsource_XF", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/15" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0497", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2014-0497:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "sourcePath": "retained:/originalText", "text": "Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2014-0497:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "sourcePath": "retained:/sourceAction", "text": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "modifiedAt": "2024-09-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-22T00:05:39.174Z", "fetchedAt": "2026-10-24T05:11:19.981Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:11:19.981Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a4db6a9b7ecf7c041a86c21cebdc7273f6af9a5e1262a1d676ed09821d70a8e4", "sourceModifiedAt": "2025-10-22T00:05:39.174Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Adobe Flash Player の Windows と Mac OS X では 11.7.700.261 未満、または 11.8 系から 12.0 系で 12.0.0.44 未満、Linux では 11.2.202.336 未満のバージョンに整数アンダーフローがあり、リモート攻撃者が未指定のベクトルを通じて任意のコードを実行できる可能性があります。", "risk": "リモート攻撃者が任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "整数アンダーフローが存在すること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json" ], "evidenceIds": [ "E1" ] }, { "text": "リモート攻撃者が未指定のベクトルを利用できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Adobe Flash Player」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2014-0497", "http://www.exploit-db.com/exploits/33212", "http://helpx.adobe.com/security/products/flash-player/apsb14-04.html", "http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html", "http://rhn.redhat.com/errata/RHSA-2014-0137.html", "http://www.osvdb.org/102849", "http://www.securityfocus.com/bid/65327", "http://secunia.com/advisories/56799", "http://www.securitytracker.com/id/1029715", "http://secunia.com/advisories/56737", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2014-0497" ] } ], "actions": [ { "text": "影響を受ける製品はサポート終了またはサービス終了しているため、使用を中止すべきです。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2014-0497」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2014-0497", "http://www.exploit-db.com/exploits/33212", "http://helpx.adobe.com/security/products/flash-player/apsb14-04.html", "http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html", "http://rhn.redhat.com/errata/RHSA-2014-0137.html", "http://www.osvdb.org/102849", "http://www.securityfocus.com/bid/65327", "http://secunia.com/advisories/56799", "http://www.securitytracker.com/id/1029715", "http://secunia.com/advisories/56737", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2014-0497" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2014-0497", "http://www.exploit-db.com/exploits/33212", "http://helpx.adobe.com/security/products/flash-player/apsb14-04.html", "http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html", "http://rhn.redhat.com/errata/RHSA-2014-0137.html", "http://www.osvdb.org/102849", "http://www.securityfocus.com/bid/65327", "http://secunia.com/advisories/56799", "http://www.securitytracker.com/id/1029715", "http://secunia.com/advisories/56737", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2014-0497" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2014-0497", "http://www.exploit-db.com/exploits/33212", "http://helpx.adobe.com/security/products/flash-player/apsb14-04.html", "http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html", "http://rhn.redhat.com/errata/RHSA-2014-0137.html", "http://www.osvdb.org/102849", "http://www.securityfocus.com/bid/65327", "http://secunia.com/advisories/56799", "http://www.securitytracker.com/id/1029715", "http://secunia.com/advisories/56737", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2014-0497" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2014-0497", "http://www.exploit-db.com/exploits/33212", "http://helpx.adobe.com/security/products/flash-player/apsb14-04.html", "http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html", "http://rhn.redhat.com/errata/RHSA-2014-0137.html", "http://www.osvdb.org/102849", "http://www.securityfocus.com/bid/65327", "http://secunia.com/advisories/56799", "http://www.securitytracker.com/id/1029715", "http://secunia.com/advisories/56737", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2014-0497" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2014-0497", "label": "CVE公式レコード" }, { "url": "http://www.exploit-db.com/exploits/33212", "label": "33212" }, { "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-04.html", "label": "CVE掲載の参考情報" }, { "url": "http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html", "label": "CVE掲載の参考情報" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html", "label": "SUSE-SU-2014:0221" }, { "url": "http://rhn.redhat.com/errata/RHSA-2014-0137.html", "label": "RHSA-2014:0137" }, { "url": "http://www.osvdb.org/102849", "label": "102849" }, { "url": "http://www.securityfocus.com/bid/65327", "label": "65327" }, { "url": "http://secunia.com/advisories/56799", "label": "56799" }, { "url": "http://www.securitytracker.com/id/1029715", "label": "1029715" }, { "url": "http://secunia.com/advisories/56737", "label": "56737" }, { "url": "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0497", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "sourceField": "retained:/originalText", "excerpt": "Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0497.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "sourceField": "retained:/sourceAction", "excerpt": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0497", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2014-0497\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2014-0497（Adobe Flash Player）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・整数アンダーフローが存在すること。\n・リモート攻撃者が未指定のベクトルを利用できること。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2014-0497", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:11:19.981Z", "lastSuccess": "2026-10-24T05:11:19.981Z", "sourceCheckedAt": "2026-10-24T05:11:19.981Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2014-0502", "aliases": [], "title": "n/a：コード実行", "summary": "Adobe Flash Player の Windows、Mac OS X、Linux、Adobe AIR の Android、Adobe AIR SDK および Compiler において、指定されたバージョン以前に存在するダブルフリーの脆弱性により、リモートの攻撃者が任意のコードを実行できる可能性があります。この脆弱性は 2014 年 2 月に実際に悪用されています。", "risk": "リモートの攻撃者が任意のコードを実行できる可能性があります。", "product": "Adobe Flash Player", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "adobe", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "対象製品はサポートが終了しているため、使用を中止してください。", "「CVE-2014-0502」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2014-0502", "label": "CVE公式レコード" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html", "label": "openSUSE-SU-2014:0278" }, { "url": "https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html", "label": "CVE掲載の参考情報" }, { "url": "http://security.gentoo.org/glsa/glsa-201405-04.xml", "label": "GLSA-201405-04" }, { "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-07.html", "label": "CVE掲載の参考情報" }, { "url": "http://rhn.redhat.com/errata/RHSA-2014-0196.html", "label": "RHSA-2014:0196" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html", "label": "SUSE-SU-2014:0290" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html", "label": "openSUSE-SU-2014:0277" }, { "url": "http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/", "label": "CVE掲載の参考情報" }, { "url": "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0502", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2014-02-21T02:00:00.000Z", "modifiedAt": "2025-10-22T00:05:38.853Z", "fetchedAt": "2026-10-24T05:11:31.863Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2014-0502", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json", "fetchedAt": "2026-10-24T05:11:31.863Z", "publishedAt": "2014-02-21T02:00:00.000Z", "modifiedAt": "2025-10-22T00:05:38.853Z", "state": "published", "provider": "adobe", "title": "", "descriptions": [ { "lang": "en", "value": "Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html", "label": "openSUSE-SU-2014:0278", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://security.gentoo.org/glsa/glsa-201405-04.xml", "label": "GLSA-201405-04", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-07.html", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://rhn.redhat.com/errata/RHSA-2014-0196.html", "label": "RHSA-2014:0196", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html", "label": "SUSE-SU-2014:0290", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html", "label": "openSUSE-SU-2014:0277", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0502", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2014-0502:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "sourcePath": "retained:/originalText", "text": "Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2014-0502:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "sourcePath": "retained:/sourceAction", "text": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "modifiedAt": "2024-09-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-22T00:05:38.853Z", "fetchedAt": "2026-10-24T05:11:31.863Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-17T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:11:31.863Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7df4df8bfa60b4bfc028c03bfe2427f7967633a9253059812fab9bcbdd05f9b7", "sourceModifiedAt": "2025-10-22T00:05:38.853Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Adobe Flash Player の Windows、Mac OS X、Linux、Adobe AIR の Android、Adobe AIR SDK および Compiler において、指定されたバージョン以前に存在するダブルフリーの脆弱性により、リモートの攻撃者が任意のコードを実行できる可能性があります。この脆弱性は 2014 年 2 月に実際に悪用されています。", "risk": "リモートの攻撃者が任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "Windows および Mac OS X の Adobe Flash Player がバージョン 11.7.700.269 未満、または 11.8 系から 12.0 系でバージョン 12.0.0.70 未満の場合", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json" ], "evidenceIds": [ "E1" ] }, { "text": "Linux の Adobe Flash Player がバージョン 11.2.202.341 未満の場合", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json" ], "evidenceIds": [ "E1" ] }, { "text": "Android の Adobe AIR がバージョン 4.0.0.1628 未満の場合", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json" ], "evidenceIds": [ "E1" ] }, { "text": "Adobe AIR SDK がバージョン 4.0.0.1628 未満の場合", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json" ], "evidenceIds": [ "E1" ] }, { "text": "Adobe AIR SDK & Compiler がバージョン 4.0.0.1628 未満の場合", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Adobe Flash Player」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2014-0502", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html", "https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html", "http://security.gentoo.org/glsa/glsa-201405-04.xml", "http://helpx.adobe.com/security/products/flash-player/apsb14-07.html", "http://rhn.redhat.com/errata/RHSA-2014-0196.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html", "http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2014-0502" ] } ], "actions": [ { "text": "対象製品はサポートが終了しているため、使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2014-0502」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2014-0502", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html", "https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html", "http://security.gentoo.org/glsa/glsa-201405-04.xml", "http://helpx.adobe.com/security/products/flash-player/apsb14-07.html", "http://rhn.redhat.com/errata/RHSA-2014-0196.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html", "http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2014-0502" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2014-0502", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html", "https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html", "http://security.gentoo.org/glsa/glsa-201405-04.xml", "http://helpx.adobe.com/security/products/flash-player/apsb14-07.html", "http://rhn.redhat.com/errata/RHSA-2014-0196.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html", "http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2014-0502" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2014-0502", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html", "https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html", "http://security.gentoo.org/glsa/glsa-201405-04.xml", "http://helpx.adobe.com/security/products/flash-player/apsb14-07.html", "http://rhn.redhat.com/errata/RHSA-2014-0196.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html", "http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2014-0502" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2014-0502", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html", "https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html", "http://security.gentoo.org/glsa/glsa-201405-04.xml", "http://helpx.adobe.com/security/products/flash-player/apsb14-07.html", "http://rhn.redhat.com/errata/RHSA-2014-0196.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html", "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html", "http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "https://nvd.nist.gov/vuln/detail/CVE-2014-0502" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2014-0502", "label": "CVE公式レコード" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.html", "label": "openSUSE-SU-2014:0278" }, { "url": "https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html", "label": "CVE掲載の参考情報" }, { "url": "http://security.gentoo.org/glsa/glsa-201405-04.xml", "label": "GLSA-201405-04" }, { "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-07.html", "label": "CVE掲載の参考情報" }, { "url": "http://rhn.redhat.com/errata/RHSA-2014-0196.html", "label": "RHSA-2014:0196" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.html", "label": "SUSE-SU-2014:0290" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.html", "label": "openSUSE-SU-2014:0277" }, { "url": "http://www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe-zero-day-cve-2014-0502/", "label": "CVE掲載の参考情報" }, { "url": "https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0502", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "sourceField": "retained:/originalText", "excerpt": "Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/0xxx/CVE-2014-0502.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "sourceField": "retained:/sourceAction", "excerpt": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0502", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2014-0502\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2014-0502（Adobe Flash Player）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Windows および Mac OS X の Adobe Flash Player がバージョン 11.7.700.269 未満、または 11.8 系から 12.0 系でバージョン 12.0.0.70 未満の場合\n・Linux の Adobe Flash Player がバージョン 11.2.202.341 未満の場合\n・Android の Adobe AIR がバージョン 4.0.0.1628 未満の場合\n・Adobe AIR SDK がバージョン 4.0.0.1628 未満の場合\n・Adobe AIR SDK & Compiler がバージョン 4.0.0.1628 未満の場合\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2014-0502", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:11:31.863Z", "lastSuccess": "2026-10-24T05:11:31.863Z", "sourceCheckedAt": "2026-10-24T05:11:31.863Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2024-43461", "aliases": [], "title": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 21H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Versi：脆弱性情報", "summary": "Windows MSHTML Platformにおいて、ユーザーインターフェイスの重要情報が誤って表示される偽装脆弱性が存在します。", "risk": "攻撃者がウェブページを偽装できる可能性があります。", "product": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 21H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Versi", "category": "windows", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1507", "range": ">= 10.0.10240.0 / < 10.0.10240.20766（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.7336（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.6293（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19043.0 / < 10.0.19044.4894（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.4894（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 21H2", "range": ">= 10.0.0 / < 10.0.22000.3197（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H2", "range": ">= 10.0.22621.0 / < 10.0.22621.4169（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H3", "range": ">= 10.0.22631.0 / < 10.0.22631.4169（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.4169（環境: x64-based Systems）" }, { "product": "Windows 11 Version 24H2", "range": ">= 10.0.26100.0 / < 10.0.26100.1742（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.22870（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1", "range": ">= 6.1.7601.0 / < 6.1.7601.27320（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "range": ">= 6.1.7601.0 / < 6.1.7601.27320（環境: x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.22870（環境: 32-bit Systems）" }, { "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "range": ">= 6.0.6003.0 / < 6.0.6003.22870（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.25073（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.25073（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.22175（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.22175（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.7336（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.7336（環境: x64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.6293（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.6293（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.2700（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.1128（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2024-43461」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-43461", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43461", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2024-09-10T16:54:14.430Z", "modifiedAt": "2026-08-10T15:10:50.429Z", "fetchedAt": "2026-10-24T07:16:35.645Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows MSHTML Platform Spoofing Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.10240.0", "lessThan": "10.0.10240.20766", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7336", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.6293", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19043.0", "lessThan": "10.0.19044.4894", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.4894", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.0", "lessThan": "10.0.22000.3197", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22621.0", "lessThan": "10.0.22621.4169", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.4169", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.4169", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.1742", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22870", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27320", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.27320", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "32-bit Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22870", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22870", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25073", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25073", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22175", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.22175", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7336", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.7336", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.6293", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.6293", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.2700", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.1128", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-43461", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "fetchedAt": "2026-10-24T07:16:35.645Z", "publishedAt": "2024-09-10T16:54:14.430Z", "modifiedAt": "2026-08-10T15:10:50.429Z", "state": "published", "provider": "microsoft", "title": "Windows MSHTML Platform Spoofing Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Windows MSHTML Platform Spoofing Vulnerability", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.10240.0", "lessThan": "10.0.10240.20766", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7336", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.6293", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/3", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.19043.0", "lessThan": "10.0.19044.4894", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/4", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.4894", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.0", "lessThan": "10.0.22000.3197", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "sourcePath": "/containers/cna/affected/6", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.22621.0", "lessThan": "10.0.22621.4169", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "sourcePath": "/containers/cna/affected/7", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.4169", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.4169", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "sourcePath": "/containers/cna/affected/9", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.1742", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22870", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27320", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "sourcePath": "/containers/cna/affected/12", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.27320", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/13", "platforms": [ "32-bit Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22870", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "sourcePath": "/containers/cna/affected/14", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22870", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25073", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25073", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22175", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.22175", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7336", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.7336", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/21", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/21/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.6293", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/22", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/22/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.6293", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/23", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/23/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.2700", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/24", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/24/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.1128", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-451", "lang": "en-US", "description": "CWE-451: User Interface (UI) Misrepresentation of Critical Information", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461", "label": "Windows MSHTML Platform Spoofing Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43461", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20766\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7336\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6293\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19044.4894\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.4894\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.22000.3197\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.4169\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.4169\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.4169\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.1742\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22870\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27320\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27320\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22870\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22870\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25073\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25073\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22175\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22175\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7336\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7336\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/21", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6293\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/22", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6293\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/23", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2700\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/affected/24", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.1128\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Windows MSHTML Platform Spoofing Vulnerability", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-451: User Interface (UI) Misrepresentation of Critical Information\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-451\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-43461:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "sourcePath": "retained:/originalText", "text": "Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-43461:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "modifiedAt": "2024-09-16T00:00:00.000Z", "fetchedAt": "2026-10-24T06:17:49.270Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-10T15:10:50.429Z", "fetchedAt": "2026-10-24T07:16:35.645Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-16T00:00:00.000Z", "fetchedAt": "2026-10-24T06:17:49.270Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 21H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Versiに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T07:16:35.645Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "175fc252229cd3b1665d7a402e37b9de3ea63d1861aafdd2de6ceb4415a7e955", "sourceModifiedAt": "2026-08-10T15:10:50.429Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows MSHTML Platformにおいて、ユーザーインターフェイスの重要情報が誤って表示される偽装脆弱性が存在します。", "risk": "攻撃者がウェブページを偽装できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20766未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7336未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.6293未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19044.4894未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.4894未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.0以上、10.0.22000.3197未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.4169未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.4169未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.4169未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.1742未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22870未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27320未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27320未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22870未満。対象の環境：32-bit Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.22870未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25073未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25073未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22175未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22175未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7336未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E23" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7336未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E24" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.6293未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E25" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.6293未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E26" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2700未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E27" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.1128未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E28" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461" ], "evidenceIds": [ "E30" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E4" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461" ], "evidenceIds": [ "E29" ] }, { "text": "「CVE-2024-43461」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-43461", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "https://nvd.nist.gov/vuln/detail/CVE-2024-43461" ] }, { "text": "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2024-43461", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "https://nvd.nist.gov/vuln/detail/CVE-2024-43461" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json" ], "evidenceIds": [ "E4" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-43461", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43461", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Windows MSHTML Platform Spoofing Vulnerability", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/title", "excerpt": "Windows MSHTML Platform Spoofing Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "sourceField": "retained:/originalText", "excerpt": "Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20766\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7336\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6293\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19044.4894\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.4894\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.22000.3197\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.4169\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.4169\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.4169\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.1742\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22870\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27320\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.27320\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22870\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22870\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25073\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25073\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22175\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.22175\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7336\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.7336\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/21", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6293\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E26", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/22", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.6293\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E27", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/23", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2700\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E28", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43461.json", "sourceField": "/containers/cna/affected/24", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.1128\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E29", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E30", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43461", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-43461\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-43461（Windows 10 Version 1507 / Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 21H2 / Windows 11 version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Versi）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20766未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.7336未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.6293未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19044.4894未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.4894未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.0以上、10.0.22000.3197未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.4169未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.4169未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.4169未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.1742未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22870未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.27320未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.27320未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22870未満。対象の環境：32-bit Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.22870未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25073未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25073未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.22175未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.22175未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.7336未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.7336未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.6293未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.6293未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2700未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.1128未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-43461", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T07:16:35.645Z", "lastSuccess": "2026-10-24T07:16:35.645Z", "sourceCheckedAt": "2026-10-24T07:16:35.645Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-6670", "aliases": [], "title": "WhatsUp Gold：認証の回避", "summary": "WhatsUp Gold の 2024.0.0 より前にリリースされたバージョンにおいて、SQL インジェクション脆弱性が存在し、認証されていない攻撃者がユーザーの暗号化されたパスワードを取得できる可能性があります。", "risk": "攻撃者がユーザーの暗号化されたパスワードを取得できることにより、認証情報が漏洩するリスクがあります。", "product": "WhatsUp Gold", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "ProgressSoftware", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "WhatsUp Gold", "range": ">= 2023.1.0 / < 2024.0.0（環境: Windows、機能: API Endpoint）" }, { "product": "WhatsUp Gold", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。（環境: Windows、機能: API Endpoint）" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2024-6670」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json", "label": "CVE：ProgressSoftware" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-6670", "label": "CVE公式レコード" }, { "url": "https://www.progress.com/network-monitoring", "label": "CVE掲載の参考情報" }, { "url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6670", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-08-29T22:04:41.139Z", "modifiedAt": "2025-10-21T22:55:46.285Z", "fetchedAt": "2026-10-24T05:11:32.357Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.", "sourceTitle": "WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "modules": [ "API Endpoint" ], "platforms": [ "Windows" ], "product": "WhatsUp Gold", "vendor": "Progress Software Corporation", "versions": [ { "lessThan": "2024.0.0", "status": "affected", "version": "2023.1.0", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: Windows / API Endpoint。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-6670", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json", "fetchedAt": "2026-10-24T05:11:32.357Z", "publishedAt": "2024-08-29T22:04:41.139Z", "modifiedAt": "2025-10-21T22:55:46.285Z", "state": "published", "provider": "ProgressSoftware", "title": "WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability", "descriptions": [ { "lang": "en", "value": "In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Progress Software Corporation", "product": "WhatsUp Gold", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [ "Windows" ], "modules": [ "API Endpoint" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "2023.1.0", "lessThan": "2024.0.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "ProgressSoftware", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.progress.com/network-monitoring", "label": "ProgressSoftware", "tags": [ "product" ], "provider": "ProgressSoftware", "sourcePath": "/containers/cna/references/0" }, { "url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024", "label": "ProgressSoftware", "tags": [ "vendor-advisory" ], "provider": "ProgressSoftware", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6670", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"modules\":[\"API Endpoint\"],\"platforms\":[\"Windows\"],\"product\":\"WhatsUp Gold\",\"vendor\":\"Progress Software Corporation\",\"versions\":[{\"lessThan\":\"2024.0.0\",\"status\":\"affected\",\"version\":\"2023.1.0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-89\",\"description\":\"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-6670:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "sourcePath": "retained:/originalText", "text": "Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-6670:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "modifiedAt": "2024-09-16T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:46.285Z", "fetchedAt": "2026-10-24T05:11:32.357Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-16T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "WhatsUp Goldに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:11:32.357Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "45f2916226ecf053eca708137614936fa14d7b305e88ccda23374d4df474bb75", "sourceModifiedAt": "2025-10-21T22:55:46.285Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "WhatsUp Gold の 2024.0.0 より前にリリースされたバージョンにおいて、SQL インジェクション脆弱性が存在し、認証されていない攻撃者がユーザーの暗号化されたパスワードを取得できる可能性があります。", "risk": "攻撃者がユーザーの暗号化されたパスワードを取得できることにより、認証情報が漏洩するリスクがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "攻撃者は認証されていない状態で攻撃を実行できることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "対象となるシステムが単一ユーザーで構成されている設定であることが必要です。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "影響を受けるプラットフォームは Windows です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "影響を受けるモジュールは API Endpoint です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "バージョンが 2024.0.0 未満（2023.1.0 以降）であることが条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：Progress Software Corporation / WhatsUp Gold。影響ありとして記載：2023.1.0以上、2024.0.0未満。対象の環境：Windows。対象の機能：API Endpoint。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670" ], "evidenceIds": [ "E7" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json" ], "evidenceIds": [ "E4" ] }, { "text": "「WhatsUp Gold」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-6670", "https://www.progress.com/network-monitoring", "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "https://nvd.nist.gov/vuln/detail/CVE-2024-6670" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670" ], "evidenceIds": [ "E5", "E6" ] }, { "text": "「CVE-2024-6670」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-6670", "https://www.progress.com/network-monitoring", "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "https://nvd.nist.gov/vuln/detail/CVE-2024-6670" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-6670", "https://www.progress.com/network-monitoring", "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "https://nvd.nist.gov/vuln/detail/CVE-2024-6670" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-6670", "https://www.progress.com/network-monitoring", "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "https://nvd.nist.gov/vuln/detail/CVE-2024-6670" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-6670", "https://www.progress.com/network-monitoring", "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "https://nvd.nist.gov/vuln/detail/CVE-2024-6670" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json", "label": "CVE：ProgressSoftware" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-6670", "label": "CVE公式レコード" }, { "url": "https://www.progress.com/network-monitoring", "label": "CVE掲載の参考情報" }, { "url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6670", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json", "sourceField": "/containers/cna/title", "excerpt": "WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "sourceField": "retained:/originalText", "excerpt": "Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6670.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"modules\":[\"API Endpoint\"],\"platforms\":[\"Windows\"],\"product\":\"WhatsUp Gold\",\"vendor\":\"Progress Software Corporation\",\"versions\":[{\"lessThan\":\"2024.0.0\",\"status\":\"affected\",\"version\":\"2023.1.0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "sourceField": "/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-6670\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-6670（WhatsUp Gold）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者は認証されていない状態で攻撃を実行できることが前提です。\n・対象となるシステムが単一ユーザーで構成されている設定であることが必要です。\n・影響を受けるプラットフォームは Windows です。\n・影響を受けるモジュールは API Endpoint です。\n・バージョンが 2024.0.0 未満（2023.1.0 以降）であることが条件です。\n・公式の対象表：Progress Software Corporation / WhatsUp Gold。影響ありとして記載：2023.1.0以上、2024.0.0未満。対象の環境：Windows。対象の機能：API Endpoint。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-6670", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:11:32.357Z", "lastSuccess": "2026-10-24T05:11:32.357Z", "sourceCheckedAt": "2026-10-24T05:11:32.357Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2024-8190", "aliases": [], "title": "CSA (Cloud Services Appliance)：コード実行", "summary": "Ivanti Cloud Services Appliance（CSA）のバージョン4.6 Patch 518以前に OS コマンドインジェクションの脆弱性があり、リモートで認証された攻撃者が管理者権限を持っていると、サーバー上で任意のコードを実行できるようになります。", "risk": "攻撃者はサーバーや機器に対して任意のコードを実行させられる可能性があります。", "product": "CSA (Cloud Services Appliance)", "category": "other", "component": "package", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "ivanti", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "CSA (Cloud Services Appliance)", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "CSA 4.6 系統はサポートが終了しているため、サービスから削除するか、サポートされている 5.0 系統へアップグレードすることが推奨されます。", "「CVE-2024-8190」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json", "label": "CVE：ivanti" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8190", "label": "CVE公式レコード" }, { "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8190", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-09-10T20:33:44.793Z", "modifiedAt": "2025-10-21T22:55:44.915Z", "fetchedAt": "2026-10-24T05:11:36.714Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "CSA (Cloud Services Appliance)", "vendor": "Ivanti", "versions": [ { "status": "unaffected", "version": "4.6 Patch 519", "versionType": "custom" }, { "status": "unaffected", "version": "5.0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-8190", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json", "fetchedAt": "2026-10-24T05:11:36.714Z", "publishedAt": "2024-09-10T20:33:44.793Z", "modifiedAt": "2025-10-21T22:55:44.915Z", "state": "published", "provider": "ivanti", "title": "", "descriptions": [ { "lang": "en", "value": "An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Ivanti", "product": "CSA (Cloud Services Appliance)", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "4.6 Patch 519", "versionType": "custom", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "5.0", "versionType": "custom", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "ivanti", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190", "label": "ivanti", "tags": [], "provider": "ivanti", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8190", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/news-events/alerts/2024/09/13/ivanti-releases-security-update-cloud-services-appliance", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"CSA (Cloud Services Appliance)\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"4.6 Patch 519\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"5.0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-78\",\"description\":\"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2024-8190:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "sourcePath": "retained:/originalText", "text": "Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2024-8190:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "sourcePath": "retained:/sourceAction", "text": "As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "modifiedAt": "2024-09-13T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T22:55:44.915Z", "fetchedAt": "2026-10-24T05:11:36.714Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2024-09-13T00:00:00.000Z", "fetchedAt": "2026-10-24T04:17:49.204Z", "state": "published" } ], "sourceAction": "As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.", "sourceSummary": "CSA (Cloud Services Appliance)にコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:11:36.714Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "cd63ee189bd748f24963b253a5c071a3c16472a770d776fd4c468445d39373a2", "sourceModifiedAt": "2025-10-21T22:55:44.915Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Ivanti Cloud Services Appliance（CSA）のバージョン4.6 Patch 518以前に OS コマンドインジェクションの脆弱性があり、リモートで認証された攻撃者が管理者権限を持っていると、サーバー上で任意のコードを実行できるようになります。", "risk": "攻撃者はサーバーや機器に対して任意のコードを実行させられる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者はリモートで認証済みである必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者はアプリケーションの管理者権限（admin レベル）を持っている必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "対象製品は Ivanti Cloud Services Appliance（CSA）です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json" ], "evidenceIds": [ "E1" ] }, { "text": "脆弱性は CSA のバージョン 4.6 Patch 518 以前に存在します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json" ], "evidenceIds": [ "E3" ] }, { "text": "攻撃は管理コンソールから OS コマンドを注入する形で行われます。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Ivanti / CSA (Cloud Services Appliance)。影響なしとして記載：4.6 Patch 519。影響なしとして記載：5.0。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json" ], "evidenceIds": [ "E3" ] }, { "text": "「CSA (Cloud Services Appliance)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-8190", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "https://nvd.nist.gov/vuln/detail/CVE-2024-8190" ] } ], "actions": [ { "text": "CSA 4.6 系統はサポートが終了しているため、サービスから削除するか、サポートされている 5.0 系統へアップグレードすることが推奨されます。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2024-8190」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-8190", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "https://nvd.nist.gov/vuln/detail/CVE-2024-8190" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-8190", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "https://nvd.nist.gov/vuln/detail/CVE-2024-8190" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-8190", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "https://nvd.nist.gov/vuln/detail/CVE-2024-8190" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-8190", "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "https://nvd.nist.gov/vuln/detail/CVE-2024-8190" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json", "label": "CVE：ivanti" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-8190", "label": "CVE公式レコード" }, { "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8190", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "sourceField": "retained:/originalText", "excerpt": "Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/8xxx/CVE-2024-8190.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"CSA (Cloud Services Appliance)\",\"vendor\":\"Ivanti\",\"versions\":[{\"status\":\"unaffected\",\"version\":\"4.6 Patch 519\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"5.0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "sourceField": "retained:/sourceAction", "excerpt": "As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-8190\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-8190（CSA (Cloud Services Appliance)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者はリモートで認証済みである必要があります。\n・攻撃者はアプリケーションの管理者権限（admin レベル）を持っている必要があります。\n・対象製品は Ivanti Cloud Services Appliance（CSA）です。\n・脆弱性は CSA のバージョン 4.6 Patch 518 以前に存在します。\n・攻撃は管理コンソールから OS コマンドを注入する形で行われます。\n・公式の対象表：Ivanti / CSA (Cloud Services Appliance)。影響なしとして記載：4.6 Patch 519。影響なしとして記載：5.0。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-8190", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:11:36.714Z", "lastSuccess": "2026-10-24T05:11:36.714Z", "sourceCheckedAt": "2026-10-24T05:11:36.714Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } } ], "total": 2264, "limit": 20, "offset": 1060, "filters": { "product": "all", "type": "all", "q": "", "page": 54 }, "pagination": { "page": 54, "pageSize": 20, "totalPages": 114 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-24T21:17:49.557Z", "lastAttempt": "2026-10-24T21:17:49.557Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-24T21:17:49.557Z", "lastAttempt": "2026-10-24T21:17:49.557Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-24T21:17:49.557Z", "lastAttempt": "2026-10-24T21:17:49.557Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-24T16:17:49.075Z", "lastAttempt": "2026-10-24T21:17:49.557Z", "error": null, "recordCount": 19, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-24T13:02:49.742Z 〜 2026-10-24T16:17:49.075Z、全製品の変更 2744/2744件まで確認、対象19件反映。", "cursor": null, "freshness": "stale", "stale": true }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-24T21:17:49.557Z", "lastAttempt": "2026-10-24T21:17:49.557Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }