{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2023-36584", "aliases": [], "title": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 10 Version 1507 / W：脆弱性情報", "summary": "Windows Mark of the Web のセキュリティ機能バイパス脆弱性", "risk": "セキュリティ機能の完全性と可用性が限定的に失われる可能性があります。", "product": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 10 Version 1507 / W", "category": "windows", "component": "package", "severity": "medium", "cvss": 5.4, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.4974（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.0 / < 10.0.17763.4974（環境: ARM64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.4974（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.4974（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.2031（環境: x64-based Systems）" }, { "product": "Windows 11 version 21H2", "range": ">= 10.0.0 / < 10.0.22000.2538（環境: x64-based Systems / ARM64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19043.0 / < 10.0.19041.3570（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H2", "range": ">= 10.0.22621.0 / < 10.0.22621.2428（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.3570（環境: x64-based Systems / ARM64-based Systems / 32-bit Systems）" }, { "product": "Windows 10 Version 1507", "range": ">= 10.0.10240.0 / < 10.0.10240.20232（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.6351（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.6351（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.6351（環境: x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.22317（環境: 32-bit Systems）" }, { "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "range": ">= 6.0.6003.0 / < 6.0.6003.22317（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.22317（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1", "range": ">= 6.1.7601.0 / < 6.1.7601.26769（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "range": ">= 6.1.7601.0 / < 6.1.7601.26769（環境: x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.24523（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.24523（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.21620（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.21620（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2023-36584」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36584", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36584", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36584", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2023-10-10T17:07:51.709Z", "modifiedAt": "2026-01-12T21:11:08.983Z", "fetchedAt": "2026-10-24T05:24:00.021Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows Mark of the Web Security Feature Bypass Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.4974", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.0", "lessThan": "10.0.17763.4974", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.4974", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.4974", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.2031", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "platforms": [ "x64-based Systems", "ARM64-based Systems" ], "versions": [ { "version": "10.0.0", "lessThan": "10.0.22000.2538", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19043.0", "lessThan": "10.0.19041.3570", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22621.0", "lessThan": "10.0.22621.2428", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "x64-based Systems", "ARM64-based Systems", "32-bit Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.3570", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.10240.0", "lessThan": "10.0.10240.20232", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.6351", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.6351", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.6351", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "32-bit Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.26769", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.26769", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.24523", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.24523", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.21620", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.21620", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-36584", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "fetchedAt": "2026-10-24T05:24:00.021Z", "publishedAt": "2023-10-10T17:07:51.709Z", "modifiedAt": "2026-01-12T21:11:08.983Z", "state": "published", "provider": "microsoft", "title": "Windows Mark of the Web Security Feature Bypass Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Windows Mark of the Web Security Feature Bypass Vulnerability", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.4974", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/1", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.0", "lessThan": "10.0.17763.4974", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.4974", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/3", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.4974", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/4", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.2031", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "x64-based Systems", "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.0", "lessThan": "10.0.22000.2538", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/6", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.19043.0", "lessThan": "10.0.19041.3570", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "sourcePath": "/containers/cna/affected/7", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.22621.0", "lessThan": "10.0.22621.2428", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "x64-based Systems", "ARM64-based Systems", "32-bit Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.3570", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "sourcePath": "/containers/cna/affected/9", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "10.0.10240.0", "lessThan": "10.0.10240.20232", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/10", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.6351", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.6351", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/12", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.6351", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/13", "platforms": [ "32-bit Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "sourcePath": "/containers/cna/affected/14", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.26769", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.26769", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.24523", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.24523", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.21620", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/21", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/21/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.21620", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en-US", "description": "Security Feature Bypass", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C", "baseScore": 5.4, "baseSeverity": "MEDIUM", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36584", "label": "Windows Mark of the Web Security Feature Bypass Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36584", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.4974\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.17763.4974\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.4974\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.4974\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2031\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.22000.2538\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19041.3570\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.2428\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\",\"32-bit Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.3570\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20232\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6351\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6351\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6351\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22317\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22317\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22317\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26769\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26769\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24523\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24523\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21620\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/affected/21", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21620\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Windows Mark of the Web Security Feature Bypass Vulnerability", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Security Feature Bypass\",\"lang\":\"en-US\",\"type\":\"Impact\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.4,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-36584:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "sourcePath": "retained:/originalText", "text": "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-36584:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "modifiedAt": "2023-11-16T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-01-12T21:11:08.983Z", "fetchedAt": "2026-10-24T05:24:00.021Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-16T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 10 Version 1507 / Wに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:24:00.021Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "4222975562482269bff57e6947aed083b79a6d4222e8372955fedc4ccdb06340", "sourceModifiedAt": "2026-01-12T21:11:08.983Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows Mark of the Web のセキュリティ機能バイパス脆弱性", "risk": "セキュリティ機能の完全性と可用性が限定的に失われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.4974未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.0以上、10.0.17763.4974未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.4974未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.4974未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2031未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.0以上、10.0.22000.2538未満。対象の環境：x64-based Systems、ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19041.3570未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.2428未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.3570未満。対象の環境：x64-based Systems、ARM64-based Systems、32-bit Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20232未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.6351未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.6351未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.6351未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22317未満。対象の環境：32-bit Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.22317未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22317未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.26769未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.26769未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.24523未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.24523未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E23" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.21620未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E24" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.21620未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E25" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584" ], "evidenceIds": [ "E27" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E4" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584" ], "evidenceIds": [ "E26" ] }, { "text": "「CVE-2023-36584」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36584", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36584", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "https://nvd.nist.gov/vuln/detail/CVE-2023-36584" ] }, { "text": "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2023-36584", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36584", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "https://nvd.nist.gov/vuln/detail/CVE-2023-36584" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json" ], "evidenceIds": [ "E4" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36584", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36584", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36584", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Windows Mark of the Web Security Feature Bypass Vulnerability", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/title", "excerpt": "Windows Mark of the Web Security Feature Bypass Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "sourceField": "retained:/originalText", "excerpt": "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.4974\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.17763.4974\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.4974\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.4974\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2031\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.22000.2538\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19041.3570\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.2428\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\",\"32-bit Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.3570\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20232\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6351\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6351\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6351\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22317\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22317\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22317\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26769\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26769\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24523\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24523\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21620\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36584.json", "sourceField": "/containers/cna/affected/21", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21620\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E26", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E27", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-36584\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-36584（Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 10 Version 1507 / W）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.4974未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.0以上、10.0.17763.4974未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.4974未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.4974未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2031未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.0以上、10.0.22000.2538未満。対象の環境：x64-based Systems、ARM64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19041.3570未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.2428未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.3570未満。対象の環境：x64-based Systems、ARM64-based Systems、32-bit Systems\n・公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20232未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.6351未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.6351未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.6351未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22317未満。対象の環境：32-bit Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.22317未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22317未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.26769未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.26769未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.24523未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.24523未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.21620未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.21620未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-36584", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:24:00.021Z", "lastSuccess": "2026-10-24T05:24:00.021Z", "sourceCheckedAt": "2026-10-24T05:24:00.021Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-36025", "aliases": [], "title": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / W：脆弱性情報", "summary": "Microsoft Windows SmartScreen にセキュリティ機能バイパスの脆弱性があり、攻撃者が Windows Defender SmartScreen のチェックやそれに伴うプロンプトを回避できる可能性があります。", "risk": "攻撃者が Windows Defender SmartScreen のチェックやプロンプトを回避できる可能性がある。", "product": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / W", "category": "windows", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.5122（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.0 / < 10.0.17763.5122（環境: ARM64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.5122（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.5122（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.2113（環境: x64-based Systems）" }, { "product": "Windows 11 version 21H2", "range": ">= 10.0.0 / < 10.0.22000.2600（環境: x64-based Systems / ARM64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19043.0 / < 10.0.19043.3693（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H2", "range": ">= 10.0.22621.0 / < 10.0.22621.2715（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.3693（環境: x64-based Systems / ARM64-based Systems / 32-bit Systems）" }, { "product": "Windows 11 version 22H3", "range": ">= 10.0.22631.0 / < 10.0.22631.2715（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.2715（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.531（環境: x64-based Systems）" }, { "product": "Windows 10 Version 1507", "range": ">= 10.0.10240.0 / < 10.0.10240.20308（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.6452（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.6452（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.6452（環境: x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.22367（環境: 32-bit Systems）" }, { "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "range": ">= 6.0.6003.0 / < 6.0.6003.22367（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.22367（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1", "range": ">= 6.1.7601.0 / < 6.1.7601.26816（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "range": ">= 6.1.7601.0 / < 6.1.7601.26816（環境: x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.24569（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.24569（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.21668（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.21668（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2023-36025」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36025", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025", "label": "Windows SmartScreen Security Feature Bypass Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36025", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36025", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2023-11-14T17:57:39.104Z", "modifiedAt": "2025-10-21T23:05:32.342Z", "fetchedAt": "2026-10-24T07:22:44.634Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows SmartScreen Security Feature Bypass Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.2113", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "platforms": [ "x64-based Systems", "ARM64-based Systems" ], "versions": [ { "version": "10.0.0", "lessThan": "10.0.22000.2600", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19043.0", "lessThan": "10.0.19043.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22621.0", "lessThan": "10.0.22621.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "x64-based Systems", "ARM64-based Systems", "32-bit Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.531", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.10240.0", "lessThan": "10.0.10240.20308", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "32-bit Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.26816", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.26816", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.24569", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.24569", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.21668", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.21668", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-36025", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "fetchedAt": "2026-10-24T07:22:44.634Z", "publishedAt": "2023-11-14T17:57:39.104Z", "modifiedAt": "2025-10-21T23:05:32.342Z", "state": "published", "provider": "microsoft", "title": "Windows SmartScreen Security Feature Bypass Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Windows SmartScreen Security Feature Bypass Vulnerability", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/1", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/3", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/4", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.2113", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "x64-based Systems", "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.0", "lessThan": "10.0.22000.2600", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/6", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.19043.0", "lessThan": "10.0.19043.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "sourcePath": "/containers/cna/affected/7", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.22621.0", "lessThan": "10.0.22621.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "x64-based Systems", "ARM64-based Systems", "32-bit Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "sourcePath": "/containers/cna/affected/9", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.531", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "sourcePath": "/containers/cna/affected/12", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "10.0.10240.0", "lessThan": "10.0.10240.20308", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/13", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/14", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/16", "platforms": [ "32-bit Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "sourcePath": "/containers/cna/affected/17", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.26816", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.26816", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/21", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/21/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.24569", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/22", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/22/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.24569", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/23", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/23/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.21668", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/24", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/24/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.21668", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en-US", "description": "Security Feature Bypass", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025", "label": "Windows SmartScreen Security Feature Bypass Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36025", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2113\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.22000.2600\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19043.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\",\"32-bit Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.531\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20308\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26816\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26816\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/21", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24569\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/22", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24569\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/23", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21668\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/affected/24", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21668\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Windows SmartScreen Security Feature Bypass Vulnerability", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Security Feature Bypass\",\"lang\":\"en-US\",\"type\":\"Impact\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-36025:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "sourcePath": "retained:/originalText", "text": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-36025:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "modifiedAt": "2023-11-14T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:32.342Z", "fetchedAt": "2026-10-24T07:22:44.634Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-14T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / Wに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T07:22:44.634Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f34e616326955d5111f8e4d2cd5214fddaf3c12ba1b1810b8454bee43d4aeb7f", "sourceModifiedAt": "2025-10-21T23:05:32.342Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Windows SmartScreen にセキュリティ機能バイパスの脆弱性があり、攻撃者が Windows Defender SmartScreen のチェックやそれに伴うプロンプトを回避できる可能性があります。", "risk": "攻撃者が Windows Defender SmartScreen のチェックやプロンプトを回避できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.0以上、10.0.17763.5122未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2113未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.0以上、10.0.22000.2600未満。対象の環境：x64-based Systems、ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19043.3693未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.2715未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.3693未満。対象の環境：x64-based Systems、ARM64-based Systems、32-bit Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.531未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20308未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：32-bit Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.26816未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.26816未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E23" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.24569未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E24" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.24569未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E25" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.21668未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E26" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.21668未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E27" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025" ], "evidenceIds": [ "E29" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025" ], "evidenceIds": [ "E28" ] }, { "text": "「CVE-2023-36025」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36025", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36025", "https://nvd.nist.gov/vuln/detail/CVE-2023-36025" ] }, { "text": "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2023-36025", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36025", "https://nvd.nist.gov/vuln/detail/CVE-2023-36025" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36025", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025", "label": "Windows SmartScreen Security Feature Bypass Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36025", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36025", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "sourceField": "retained:/originalText", "excerpt": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.", "language": "en", "representation": "retained_feed_field" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/title", "excerpt": "Windows SmartScreen Security Feature Bypass Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2113\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.22000.2600\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19043.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\",\"32-bit Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.531\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20308\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26816\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26816\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/21", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24569\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/22", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24569\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E26", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/23", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21668\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E27", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36025.json", "sourceField": "/containers/cna/affected/24", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21668\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E28", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E29", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-36025\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-36025（Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / W）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.0以上、10.0.17763.5122未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2113未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.0以上、10.0.22000.2600未満。対象の環境：x64-based Systems、ARM64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19043.3693未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.2715未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.3693未満。対象の環境：x64-based Systems、ARM64-based Systems、32-bit Systems\n・公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.531未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20308未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：32-bit Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.26816未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.26816未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.24569未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.24569未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.21668未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.21668未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-36025", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T07:22:44.634Z", "lastSuccess": "2026-10-24T07:22:44.634Z", "sourceCheckedAt": "2026-10-24T07:22:44.634Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-36033", "aliases": [], "title": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / W：権限の奪取", "summary": "Windows DWM Core Library に未指定の脆弱性があり、特権昇格が可能になる。", "risk": "攻撃者がこの脆弱性を利用すると、特権昇格が可能になる。", "product": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / W", "category": "windows", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.5122（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.0 / < 10.0.17763.5122（環境: ARM64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.5122（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.5122（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.2113（環境: x64-based Systems）" }, { "product": "Windows 11 version 21H2", "range": ">= 10.0.0 / < 10.0.22000.2600（環境: x64-based Systems / ARM64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19043.0 / < 10.0.19043.3693（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H2", "range": ">= 10.0.22621.0 / < 10.0.22621.2715（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.3693（環境: x64-based Systems / ARM64-based Systems / 32-bit Systems）" }, { "product": "Windows 11 version 22H3", "range": ">= 10.0.22631.0 / < 10.0.22631.2715（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.2715（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.531（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "「CVE-2023-36033」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36033", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36033", "label": "Windows DWM Core Library Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36033", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36033", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2023-11-14T17:57:37.286Z", "modifiedAt": "2025-10-21T23:05:32.497Z", "fetchedAt": "2026-10-24T05:24:00.884Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows DWM Core Library Elevation of Privilege Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.2113", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "platforms": [ "x64-based Systems", "ARM64-based Systems" ], "versions": [ { "version": "10.0.0", "lessThan": "10.0.22000.2600", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19043.0", "lessThan": "10.0.19043.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22621.0", "lessThan": "10.0.22621.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "x64-based Systems", "ARM64-based Systems", "32-bit Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.531", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-36033", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "fetchedAt": "2026-10-24T05:24:00.884Z", "publishedAt": "2023-11-14T17:57:37.286Z", "modifiedAt": "2025-10-21T23:05:32.497Z", "state": "published", "provider": "microsoft", "title": "Windows DWM Core Library Elevation of Privilege Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Windows DWM Core Library Elevation of Privilege Vulnerability", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/1", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/3", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/4", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.2113", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "x64-based Systems", "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.0", "lessThan": "10.0.22000.2600", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/6", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.19043.0", "lessThan": "10.0.19043.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "sourcePath": "/containers/cna/affected/7", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.22621.0", "lessThan": "10.0.22621.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "x64-based Systems", "ARM64-based Systems", "32-bit Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "sourcePath": "/containers/cna/affected/9", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.531", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-822", "lang": "en-US", "description": "CWE-822: Untrusted Pointer Dereference", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36033", "label": "Windows DWM Core Library Elevation of Privilege Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36033", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2113\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.22000.2600\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19043.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\",\"32-bit Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.531\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Windows DWM Core Library Elevation of Privilege Vulnerability", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-822: Untrusted Pointer Dereference\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-822\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-36033:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "sourcePath": "retained:/originalText", "text": "Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-36033:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "modifiedAt": "2023-11-14T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:32.497Z", "fetchedAt": "2026-10-24T05:24:00.884Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-14T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / Wに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:24:00.884Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c089fd94bf20ee35d34704e6f57d976ecadde220ac054fd44861e4d3fa53591a", "sourceModifiedAt": "2025-10-21T23:05:32.497Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows DWM Core Library に未指定の脆弱性があり、特権昇格が可能になる。", "risk": "攻撃者がこの脆弱性を利用すると、特権昇格が可能になる。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.0以上、10.0.17763.5122未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2113未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.0以上、10.0.22000.2600未満。対象の環境：x64-based Systems、ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19043.3693未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.2715未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.3693未満。対象の環境：x64-based Systems、ARM64-based Systems、32-bit Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.531未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E14" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033" ], "evidenceIds": [ "E16" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033" ], "evidenceIds": [ "E15" ] }, { "text": "「CVE-2023-36033」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36033", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36033", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36033", "https://nvd.nist.gov/vuln/detail/CVE-2023-36033" ] }, { "text": "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2023-36033", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36033", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36033", "https://nvd.nist.gov/vuln/detail/CVE-2023-36033" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36033", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36033", "label": "Windows DWM Core Library Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36033", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36033", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/title", "excerpt": "Windows DWM Core Library Elevation of Privilege Vulnerability", "language": null }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "sourceField": "retained:/originalText", "excerpt": "Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2113\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.22000.2600\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19043.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\",\"32-bit Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36033.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.531\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E16", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36033", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-36033\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-36033（Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / W）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.0以上、10.0.17763.5122未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2113未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.0以上、10.0.22000.2600未満。対象の環境：x64-based Systems、ARM64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19043.3693未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.2715未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.3693未満。対象の環境：x64-based Systems、ARM64-based Systems、32-bit Systems\n・公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.531未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-36033", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:24:00.884Z", "lastSuccess": "2026-10-24T05:24:00.884Z", "sourceCheckedAt": "2026-10-24T05:24:00.884Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-36036", "aliases": [], "title": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 10 Version 1507 / W：権限の奪取", "summary": "Windows Cloud Files Mini Filter Driver に特権昇格の脆弱性があり、攻撃者が SYSTEM 権限を取得できる可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、SYSTEM 権限を取得できる恐れがあります。", "product": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 10 Version 1507 / W", "category": "windows", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.5122（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.0 / < 10.0.17763.5122（環境: ARM64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.5122（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.5122（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.2113（環境: x64-based Systems）" }, { "product": "Windows 11 version 21H2", "range": ">= 10.0.0 / < 10.0.22000.2600（環境: x64-based Systems / ARM64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19043.0 / < 10.0.19043.3693（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H2", "range": ">= 10.0.22621.0 / < 10.0.22621.2715（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.3693（環境: x64-based Systems / ARM64-based Systems / 32-bit Systems）" }, { "product": "Windows 10 Version 1507", "range": ">= 10.0.10240.0 / < 10.0.10240.20308（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.6452（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.6452（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.6452（環境: x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.22367（環境: 32-bit Systems）" }, { "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "range": ">= 6.0.6003.0 / < 6.0.6003.22367（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows Server 2008 Service Pack 2", "range": ">= 6.0.6003.0 / < 6.0.6003.22367（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1", "range": ">= 6.1.7601.0 / < 6.1.7601.26816（環境: x64-based Systems）" }, { "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "range": ">= 6.1.7601.0 / < 6.1.7601.26816（環境: x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.24569（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.24569（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.21668（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.21668（環境: x64-based Systems）" }, { "product": "Windows 11 version 22H3", "range": ">= 10.0.22631.0 / < 10.0.22631.2715（環境: ARM64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.531（環境: x64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.2715（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2023-36036」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36036", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36036", "label": "Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36036", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36036", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2023-11-14T17:57:13.188Z", "modifiedAt": "2025-10-21T23:05:32.648Z", "fetchedAt": "2026-10-24T05:24:02.359Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.2113", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "platforms": [ "x64-based Systems", "ARM64-based Systems" ], "versions": [ { "version": "10.0.0", "lessThan": "10.0.22000.2600", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19043.0", "lessThan": "10.0.19043.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.22621.0", "lessThan": "10.0.22621.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "x64-based Systems", "ARM64-based Systems", "32-bit Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.10240.0", "lessThan": "10.0.10240.20308", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "32-bit Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.26816", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.1.7601.0", "lessThan": "6.1.7601.26816", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.24569", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.24569", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.21668", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.21668", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.531", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-36036", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "fetchedAt": "2026-10-24T05:24:02.359Z", "publishedAt": "2023-11-14T17:57:13.188Z", "modifiedAt": "2025-10-21T23:05:32.648Z", "state": "published", "provider": "microsoft", "title": "Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/1", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/3", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.5122", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/4", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.2113", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 21H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "x64-based Systems", "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.0", "lessThan": "10.0.22000.2600", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/6", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.19043.0", "lessThan": "10.0.19043.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H2", "sourcePath": "/containers/cna/affected/7", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.22621.0", "lessThan": "10.0.22621.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/8", "platforms": [ "x64-based Systems", "ARM64-based Systems", "32-bit Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.3693", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1507", "sourcePath": "/containers/cna/affected/9", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "10.0.10240.0", "lessThan": "10.0.10240.20308", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/10", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/12", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.6452", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/13", "platforms": [ "32-bit Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "sourcePath": "/containers/cna/affected/14", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "6.0.6003.0", "lessThan": "6.0.6003.22367", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.26816", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "6.1.7601.0", "lessThan": "6.1.7601.26816", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.24569", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.24569", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.21668", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/21", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/21/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.21668", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "sourcePath": "/containers/cna/affected/22", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/22/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/23", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/23/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.531", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/24", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/24/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.2715", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-122", "lang": "en-US", "description": "CWE-122: Heap-based Buffer Overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36036", "label": "Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36036", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2113\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.22000.2600\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19043.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\",\"32-bit Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20308\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26816\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26816\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24569\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24569\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21668\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/21", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21668\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/22", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/23", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.531\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/affected/24", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-122: Heap-based Buffer Overflow\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-122\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-36036:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "sourcePath": "retained:/originalText", "text": "Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-36036:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "modifiedAt": "2023-11-14T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:32.648Z", "fetchedAt": "2026-10-24T05:24:02.359Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-14T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 10 Version 1507 / Wに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:24:02.359Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7165822d2b104d0be4c919fd8c1dcaf82d5e8855d16fee3f03bca5bcc2181946", "sourceModifiedAt": "2025-10-21T23:05:32.648Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows Cloud Files Mini Filter Driver に特権昇格の脆弱性があり、攻撃者が SYSTEM 権限を取得できる可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、SYSTEM 権限を取得できる恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.0以上、10.0.17763.5122未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2113未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.0以上、10.0.22000.2600未満。対象の環境：x64-based Systems、ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19043.3693未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.2715未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.3693未満。対象の環境：x64-based Systems、ARM64-based Systems、32-bit Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20308未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：32-bit Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.26816未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.26816未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.24569未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.24569未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.21668未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E23" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.21668未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E24" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E25" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.531未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E26" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E27" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036" ], "evidenceIds": [ "E29" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036" ], "evidenceIds": [ "E28" ] }, { "text": "「CVE-2023-36036」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36036", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36036", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36036", "https://nvd.nist.gov/vuln/detail/CVE-2023-36036" ] }, { "text": "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2023-36036", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36036", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36036", "https://nvd.nist.gov/vuln/detail/CVE-2023-36036" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36036", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36036", "label": "Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36036", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36036", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/title", "excerpt": "Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability", "language": null }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "sourceField": "retained:/originalText", "excerpt": "Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.5122\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.2113\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 21H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.0.22000.2600\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19043.0\",\"lessThan\":\"10.0.19043.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22621.0\",\"lessThan\":\"10.0.22621.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"x64-based Systems\",\"ARM64-based Systems\",\"32-bit Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.3693\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1507\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.10240.0\",\"lessThan\":\"10.0.10240.20308\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.6452\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"32-bit Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2 (Server Core installation)\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 Service Pack 2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.0.6003.0\",\"lessThan\":\"6.0.6003.22367\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26816\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2008 R2 Service Pack 1 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.1.7601.0\",\"lessThan\":\"6.1.7601.26816\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24569\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.24569\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21668\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/21", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.21668\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/22", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E26", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/23", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.531\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E27", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36036.json", "sourceField": "/containers/cna/affected/24", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.2715\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E28", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E29", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36036", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-36036\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-36036（Windows 10 Version 1809 / Windows Server 2019 / Windows Server 2019 (Server Core installation) / Windows Server 2022 / Windows 11 version 21H2 / Windows 10 Version 21H2 / Windows 11 version 22H2 / Windows 10 Version 22H2 / Windows 10 Version 1507 / W）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.0以上、10.0.17763.5122未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.5122未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.2113未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 21H2。影響ありとして記載：10.0.0以上、10.0.22000.2600未満。対象の環境：x64-based Systems、ARM64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19043.0以上、10.0.19043.3693未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H2。影響ありとして記載：10.0.22621.0以上、10.0.22621.2715未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.3693未満。対象の環境：x64-based Systems、ARM64-based Systems、32-bit Systems\n・公式の対象表：Microsoft / Windows 10 Version 1507。影響ありとして記載：10.0.10240.0以上、10.0.10240.20308未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.6452未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：32-bit Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 Service Pack 2。影響ありとして記載：6.0.6003.0以上、6.0.6003.22367未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1。影響ありとして記載：6.1.7601.0以上、6.1.7601.26816未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)。影響ありとして記載：6.1.7601.0以上、6.1.7601.26816未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.24569未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.24569未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.21668未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.21668未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.531未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.2715未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-36036", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:24:02.359Z", "lastSuccess": "2026-10-24T05:24:02.359Z", "sourceCheckedAt": "2026-10-24T05:24:02.359Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-36844", "aliases": [], "title": "Junos OS：脆弱性情報", "summary": "Junos OS EX Series の J-Web における PHP 外部変数改ざん脆弱性で、認証されていないネットワーク上の攻撃者が特定の重要な環境変数を操作でき、部分的な完全性の喪失を引き起こす可能性があります。", "risk": "特定の PHP 環境変数が改ざんされ、部分的な完全性の喪失が生じ、他の脆弱性と組み合わせて利用される可能性があります。", "product": "Junos OS", "category": "other", "component": "package", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "juniper", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Junos OS", "range": "< 20.4R3-S9（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 21.1 / < 21.1*（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 21.2 / < 21.2R3-S6（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 21.3 / < 21.3R3-S5（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 21.4 / < 21.4R3-S5（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 22.1 / < 22.1R3-S4（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 22.2 / < 22.2R3-S2（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 22.3 / < 22.3R3-S1（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 22.4 / < 22.4R2-S2, 22.4R3（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 23.2 / < 23.2R1-S1, 23.2R2（環境: EX Series）" } ], "fixed": [], "steps": [ "以下のリリースに更新することで本問題は解決されます: 20.4R3‑S9*, 21.2R3‑S7*, 21.3R3‑S5*, 21.4R3‑S5*, 22.1R3‑S4*, 22.2R3‑S2, 22.3R3‑S1*, 22.4R2‑S2*, 22.4R3*, 23.2R1‑S1, 23.2R2*, 23.4R1* および以降のすべてのリリース。*は未公開のリリースを示します。", "「CVE-2023-36844」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "label": "CVE：juniper" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36844", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36844", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-08-17T19:17:47.904Z", "modifiedAt": "2025-10-21T23:05:40.828Z", "fetchedAt": "2026-10-24T07:48:28.171Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.\n\nUsing a crafted request an attacker is able to modify \n\ncertain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n * All versions prior to 20.4R3-S9;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S7;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S4;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to 22.3R3-S1;\n * 22.4 versions \n\nprior to \n\n22.4R2-S2, 22.4R3;\n * 23.2 versions prior to \n\n23.2R1-S1, 23.2R2.", "sourceTitle": "Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "platforms": [ "EX Series" ], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [ { "lessThan": "20.4R3-S9", "status": "affected", "version": "0", "versionType": "semver" }, { "lessThan": "21.1*", "status": "affected", "version": "21.1", "versionType": "semver" }, { "lessThan": "21.2R3-S6", "status": "affected", "version": "21.2", "versionType": "semver" }, { "lessThan": "21.3R3-S5", "status": "affected", "version": "21.3", "versionType": "semver" }, { "lessThan": "21.4R3-S5", "status": "affected", "version": "21.4", "versionType": "semver" }, { "lessThan": "22.1R3-S4", "status": "affected", "version": "22.1", "versionType": "semver" }, { "lessThan": "22.2R3-S2", "status": "affected", "version": "22.2", "versionType": "semver" }, { "lessThan": "22.3R3-S1", "status": "affected", "version": "22.3", "versionType": "semver" }, { "lessThan": "22.4R2-S2, 22.4R3", "status": "affected", "version": "22.4", "versionType": "semver" }, { "lessThan": "23.2R1-S1, 23.2R2", "status": "affected", "version": "23.2", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: EX Series。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-36844", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "fetchedAt": "2026-10-24T07:48:28.171Z", "publishedAt": "2023-08-17T19:17:47.904Z", "modifiedAt": "2025-10-21T23:05:40.828Z", "state": "published", "provider": "juniper", "title": "Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables", "descriptions": [ { "lang": "en", "value": "A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.\n\nUsing a crafted request an attacker is able to modify \n\ncertain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n * All versions prior to 20.4R3-S9;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S7;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S4;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to 22.3R3-S1;\n * 22.4 versions \n\nprior to \n\n22.4R2-S2, 22.4R3;\n * 23.2 versions prior to \n\n23.2R1-S1, 23.2R2.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Juniper Networks", "product": "Junos OS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [ "EX Series" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "20.4R3-S9", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "21.1", "lessThan": "21.1*", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "21.2", "lessThan": "21.2R3-S6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "21.3", "lessThan": "21.3R3-S5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "21.4", "lessThan": "21.4R3-S5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "22.1", "lessThan": "22.1R3-S4", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "22.2", "lessThan": "22.2R3-S2", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "22.3", "lessThan": "22.3R3-S1", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "22.4", "lessThan": "22.4R2-S2, 22.4R3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "23.2", "lessThan": "23.2R1-S1, 23.2R2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "The following software releases have been updated to resolve this specific issue: \n\n20.4R3-S9*, 21.2R3-S7*, 21.3R3-S5*, 21.4R3-S5*, 22.1R3-S4*, 22.2R3-S2, 22.3R3-S1*, 22.4R2-S2*, 22.4R3*, 23.2R1-S1, 23.2R2*, 23.4R1*, and all subsequent releases.\n\n\n*Pending Publication", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "Disable J-Web, or limit access to only trusted hosts.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [ { "lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-473", "lang": "en", "description": "CWE-473 PHP External Variable Modification", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "juniper", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE", "tags": [ "vendor-advisory", "mitigation", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36844", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"EX Series\"],\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"20.4R3-S9\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"21.1*\",\"status\":\"affected\",\"version\":\"21.1\",\"versionType\":\"semver\"},{\"lessThan\":\"21.2R3-S6\",\"status\":\"affected\",\"version\":\"21.2\",\"versionType\":\"semver\"},{\"lessThan\":\"21.3R3-S5\",\"status\":\"affected\",\"version\":\"21.3\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S5\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.1R3-S4\",\"status\":\"affected\",\"version\":\"22.1\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S2\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.3R3-S1\",\"status\":\"affected\",\"version\":\"22.3\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R2-S2, 22.4R3\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"},{\"lessThan\":\"23.2R1-S1, 23.2R2\",\"status\":\"affected\",\"version\":\"23.2\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.\n\nUsing a crafted request an attacker is able to modify \n\ncertain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n * All versions prior to 20.4R3-S9;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S7;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S4;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to 22.3R3-S1;\n * 22.4 versions \n\nprior to \n\n22.4R2-S2, 22.4R3;\n * 23.2 versions prior to \n\n23.2R1-S1, 23.2R2.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "The following software releases have been updated to resolve this specific issue: \n\n20.4R3-S9*, 21.2R3-S7*, 21.3R3-S5*, 21.4R3-S5*, 22.1R3-S4*, 22.2R3-S2, 22.3R3-S1*, 22.4R2-S2*, 22.4R3*, 23.2R1-S1, 23.2R2*, 23.4R1*, and all subsequent releases.\n\n\n*Pending Publication", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "Disable J-Web, or limit access to only trusted hosts.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-473\",\"description\":\"CWE-473 PHP External Variable Modification\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-36844:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "sourcePath": "retained:/originalText", "text": "Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-36844:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:40.828Z", "fetchedAt": "2026-10-24T07:48:28.171Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Junos OSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T07:48:28.171Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b12d5aa005e9b66bea3f696bf15496e7e698f676f455109b7cb7117542fe562f", "sourceModifiedAt": "2025-10-21T23:05:40.828Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Junos OS EX Series の J-Web における PHP 外部変数改ざん脆弱性で、認証されていないネットワーク上の攻撃者が特定の重要な環境変数を操作でき、部分的な完全性の喪失を引き起こす可能性があります。", "risk": "特定の PHP 環境変数が改ざんされ、部分的な完全性の喪失が生じ、他の脆弱性と組み合わせて利用される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者は認証されていないネットワーク上の存在である必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者は J-Web へアクセスできるネットワーク経路を持ち、細工したリクエストを送信できなければなりません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "対象は Juniper Networks の Junos OS がインストールされた EX Series デバイスです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Juniper Networks / Junos OS。影響ありとして記載：20.4R3-S9未満の版。影響ありとして記載：21.1以上、21.1*未満。影響ありとして記載：21.2以上、21.2R3-S6未満。影響ありとして記載：21.3以上、21.3R3-S5未満。影響ありとして記載：21.4以上、21.4R3-S5未満。影響ありとして記載：22.1以上、22.1R3-S4未満。影響ありとして記載：22.2以上、22.2R3-S2未満。影響ありとして記載：22.3以上、22.3R3-S1未満。影響ありとして記載：22.4以上、22.4R2-S2, 22.4R3未満。影響ありとして記載：23.2以上、23.2R1-S1, 23.2R2未満。対象の環境：EX Series", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Junos OS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36844", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36844" ] } ], "actions": [ { "text": "以下のリリースに更新することで本問題は解決されます: 20.4R3‑S9*, 21.2R3‑S7*, 21.3R3‑S5*, 21.4R3‑S5*, 22.1R3‑S4*, 22.2R3‑S2, 22.3R3‑S1*, 22.4R2‑S2*, 22.4R3*, 23.2R1‑S1, 23.2R2*, 23.4R1* および以降のすべてのリリース。*は未公開のリリースを示します。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2023-36844」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36844", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36844" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36844", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36844" ] } ], "temporaryMitigations": [ { "text": "J-Web を無効化するか、信頼できるホストのみにアクセスを制限してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json" ], "evidenceIds": [ "E5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36844", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36844" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "label": "CVE：juniper" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36844", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36844", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.\n\nUsing a crafted request an attacker is able to modify \n\ncertain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n * All versions prior to 20.4R3-S9;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S7;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S4;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to 22.3R3-S1;\n * 22.4 versions \n\nprior to \n\n22.4R2-S2, 22.4R3;\n * 23.2 versions prior to \n\n23.2R1-S1, 23.2R2.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourceField": "/containers/cna/title", "excerpt": "Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"EX Series\"],\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"20.4R3-S9\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"21.1*\",\"status\":\"affected\",\"version\":\"21.1\",\"versionType\":\"semver\"},{\"lessThan\":\"21.2R3-S6\",\"status\":\"affected\",\"version\":\"21.2\",\"versionType\":\"semver\"},{\"lessThan\":\"21.3R3-S5\",\"status\":\"affected\",\"version\":\"21.3\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S5\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.1R3-S4\",\"status\":\"affected\",\"version\":\"22.1\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S2\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.3R3-S1\",\"status\":\"affected\",\"version\":\"22.3\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R2-S2, 22.4R3\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"},{\"lessThan\":\"23.2R1-S1, 23.2R2\",\"status\":\"affected\",\"version\":\"23.2\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "The following software releases have been updated to resolve this specific issue: \n\n20.4R3-S9*, 21.2R3-S7*, 21.3R3-S5*, 21.4R3-S5*, 22.1R3-S4*, 22.2R3-S2, 22.3R3-S1*, 22.4R2-S2*, 22.4R3*, 23.2R1-S1, 23.2R2*, 23.4R1*, and all subsequent releases.\n\n\n*Pending Publication", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36844.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "Disable J-Web, or limit access to only trusted hosts.", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-36844\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-36844（Junos OS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者は認証されていないネットワーク上の存在である必要があります。\n・攻撃者は J-Web へアクセスできるネットワーク経路を持ち、細工したリクエストを送信できなければなりません。\n・対象は Juniper Networks の Junos OS がインストールされた EX Series デバイスです。\n・公式の対象表：Juniper Networks / Junos OS。影響ありとして記載：20.4R3-S9未満の版。影響ありとして記載：21.1以上、21.1*未満。影響ありとして記載：21.2以上、21.2R3-S6未満。影響ありとして記載：21.3以上、21.3R3-S5未満。影響ありとして記載：21.4以上、21.4R3-S5未満。影響ありとして記載：22.1以上、22.1R3-S4未満。影響ありとして記載：22.2以上、22.2R3-S2未満。影響ありとして記載：22.3以上、22.3R3-S1未満。影響ありとして記載：22.4以上、22.4R2-S2, 22.4R3未満。影響ありとして記載：23.2以上、23.2R1-S1, 23.2R2未満。対象の環境：EX Series\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-36844", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T07:48:28.171Z", "lastSuccess": "2026-10-24T07:48:28.171Z", "sourceCheckedAt": "2026-10-24T07:48:28.171Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-36845", "aliases": [], "title": "Junos OS：脆弱性情報", "summary": "Junos OSを使っている方が確認する情報です。製品名と版を確認し、提供元にこの番号への対応状況を問い合わせてください。公開された対象範囲を下に日本語で示しています。", "risk": "具体的な被害の種類を、取り込んだ情報から正確に整理できていません。製品を使っている場合は、CVE番号と利用中の版を添えて、影響と修正状況を提供元に確認してください。", "product": "Junos OS", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "juniper", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Junos OS", "range": "< 20.4R3-S9（環境: EX Series / SRX Series）" }, { "product": "Junos OS", "range": ">= 21.1 / < 21.1*（環境: EX Series / SRX Series）" }, { "product": "Junos OS", "range": ">= 21.2 / < 21.2R3-S7（環境: EX Series / SRX Series）" }, { "product": "Junos OS", "range": ">= 21.3 / < 21.3R3-S5（環境: EX Series / SRX Series）" }, { "product": "Junos OS", "range": ">= 21.4 / < 21.4R3-S5（環境: EX Series / SRX Series）" }, { "product": "Junos OS", "range": ">= 22.1 / < 22.1R3-S4（環境: EX Series / SRX Series）" }, { "product": "Junos OS", "range": ">= 22.2 / < 22.2R3-S2（環境: EX Series / SRX Series）" }, { "product": "Junos OS", "range": ">= 22.3 / < 22.3R2-S2, 22.3R3-S1（環境: EX Series / SRX Series）" }, { "product": "Junos OS", "range": ">= 22.4 / < 22.4R2-S1, 22.4R3（環境: EX Series / SRX Series）" }, { "product": "Junos OS", "range": ">= 23,2 / < 23.2R1-S1, 23.2R2（環境: EX Series / SRX Series）" } ], "fixed": [], "steps": [ "「CVE-2023-36845」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36845", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "label": "CISA KEV（悪用確認）" }, { "url": "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36845", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-08-17T19:17:57.183Z", "modifiedAt": "2025-10-21T23:05:40.639Z", "fetchedAt": "2026-10-24T23:55:54.884Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series \n\nand SRX Series \n\nallows an unauthenticated, network-based attacker to remotely execute code.\n\nUsing a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series\n\n\nand \n\n\nSRX Series:\n\n\n\n * All versions prior to \n\n20.4R3-S9;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S7;\n * 21.3 versions prior to 21.3R3-S5;\n * 21.4 versions prior to 21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S4;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3-S1;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3;\n * 23.2 versions prior to 23.2R1-S1, 23.2R2.", "sourceTitle": "Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable", "summaryMethod": "公開データの対象範囲・CVSS条件を日本語化し、製品ごとの一般的な操作手順を補足しています。個別の全文翻訳・環境診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "platforms": [ "EX Series", "SRX Series" ], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [ { "lessThan": "20.4R3-S9", "status": "affected", "version": "0", "versionType": "semver" }, { "lessThan": "21.1*", "status": "affected", "version": "21.1", "versionType": "semver" }, { "lessThan": "21.2R3-S7", "status": "affected", "version": "21.2", "versionType": "semver" }, { "lessThan": "21.3R3-S5", "status": "affected", "version": "21.3", "versionType": "semver" }, { "lessThan": "21.4R3-S5", "status": "affected", "version": "21.4", "versionType": "semver" }, { "lessThan": "22.1R3-S4", "status": "affected", "version": "22.1", "versionType": "semver" }, { "lessThan": "22.2R3-S2", "status": "affected", "version": "22.2", "versionType": "semver" }, { "lessThan": "22.3R2-S2, 22.3R3-S1", "status": "affected", "version": "22.3", "versionType": "semver" }, { "lessThan": "22.4R2-S1, 22.4R3", "status": "affected", "version": "22.4", "versionType": "semver" }, { "lessThan": "23.2R1-S1, 23.2R2", "status": "affected", "version": "23,2", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: EX Series / SRX Series。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-36845", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json", "fetchedAt": "2026-10-24T23:55:54.884Z", "publishedAt": "2023-08-17T19:17:57.183Z", "modifiedAt": "2025-10-21T23:05:40.639Z", "state": "published", "provider": "juniper", "title": "Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable", "descriptions": [ { "lang": "en", "value": "A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series \n\nand SRX Series \n\nallows an unauthenticated, network-based attacker to remotely execute code.\n\nUsing a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series\n\n\nand \n\n\nSRX Series:\n\n\n\n * All versions prior to \n\n20.4R3-S9;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S7;\n * 21.3 versions prior to 21.3R3-S5;\n * 21.4 versions prior to 21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S4;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3-S1;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3;\n * 23.2 versions prior to 23.2R1-S1, 23.2R2.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Juniper Networks", "product": "Junos OS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [ "EX Series", "SRX Series" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "20.4R3-S9", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "21.1", "lessThan": "21.1*", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "21.2", "lessThan": "21.2R3-S7", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "21.3", "lessThan": "21.3R3-S5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "21.4", "lessThan": "21.4R3-S5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "22.1", "lessThan": "22.1R3-S4", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "22.2", "lessThan": "22.2R3-S2", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "22.3", "lessThan": "22.3R2-S2, 22.3R3-S1", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "22.4", "lessThan": "22.4R2-S1, 22.4R3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "23,2", "lessThan": "23.2R1-S1, 23.2R2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "The following software releases have been updated to resolve this specific issue: \n\n20.4R3-S9*, 21.2R3-S7*, 21.3R3-S5, 21.4R3-S5*, 22.1R3-S4*, 22.2R3-S2, 22.3R2-S2, 22.3R3-S1*, 22.4R2-S1, 22.4R3*, 23.2R1-S1, 23.2R2*, 23.4R1*, and all subsequent releases.\n\n\n*Pending Publication", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "Disable J-Web, or limit access to only trusted hosts.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [ { "lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-473", "lang": "en", "description": "CWE-473 PHP External Variable Modification", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "juniper", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE", "tags": [ "vendor-advisory", "mitigation", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36845", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"EX Series\",\"SRX Series\"],\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"20.4R3-S9\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"21.1*\",\"status\":\"affected\",\"version\":\"21.1\",\"versionType\":\"semver\"},{\"lessThan\":\"21.2R3-S7\",\"status\":\"affected\",\"version\":\"21.2\",\"versionType\":\"semver\"},{\"lessThan\":\"21.3R3-S5\",\"status\":\"affected\",\"version\":\"21.3\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S5\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.1R3-S4\",\"status\":\"affected\",\"version\":\"22.1\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S2\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.3R2-S2, 22.3R3-S1\",\"status\":\"affected\",\"version\":\"22.3\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R2-S1, 22.4R3\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"},{\"lessThan\":\"23.2R1-S1, 23.2R2\",\"status\":\"affected\",\"version\":\"23,2\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series \n\nand SRX Series \n\nallows an unauthenticated, network-based attacker to remotely execute code.\n\nUsing a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series\n\n\nand \n\n\nSRX Series:\n\n\n\n * All versions prior to \n\n20.4R3-S9;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S7;\n * 21.3 versions prior to 21.3R3-S5;\n * 21.4 versions prior to 21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S4;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3-S1;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3;\n * 23.2 versions prior to 23.2R1-S1, 23.2R2.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "The following software releases have been updated to resolve this specific issue: \n\n20.4R3-S9*, 21.2R3-S7*, 21.3R3-S5, 21.4R3-S5*, 22.1R3-S4*, 22.2R3-S2, 22.3R2-S2, 22.3R3-S1*, 22.4R2-S1, 22.4R3*, 23.2R1-S1, 23.2R2*, 23.4R1*, and all subsequent releases.\n\n\n*Pending Publication", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "Disable J-Web, or limit access to only trusted hosts.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-473\",\"description\":\"CWE-473 PHP External Variable Modification\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-36845:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "sourcePath": "retained:/originalText", "text": "Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-36845:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T23:17:49.776Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:40.639Z", "fetchedAt": "2026-10-24T23:55:54.884Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T23:17:49.776Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Junos OSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "structured", "reviewedAt": null, "reviewState": "unreviewed", "summary": "Junos OSを使っている方が確認する情報です。製品名と版を確認し、提供元にこの番号への対応状況を問い合わせてください。公開された対象範囲を下に日本語で示しています。", "risk": "具体的な被害の種類を、取り込んだ情報から正確に整理できていません。製品を使っている場合は、CVE番号と利用中の版を添えて、影響と修正状況を提供元に確認してください。", "applicability": [ { "text": "最初に「Junos OS」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データの対象範囲：Junos OS — 20.4R3-S9未満（環境: EX Series / SRX Series）。この範囲に加え、下に記載する権限・構成などの条件も照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データの対象範囲：Junos OS — 21.1以上 かつ 21.1未満*（環境: EX Series / SRX Series）。この範囲に加え、下に記載する権限・構成などの条件も照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データの対象範囲：Junos OS — 21.2以上 かつ 21.2R3-S7未満（環境: EX Series / SRX Series）。この範囲に加え、下に記載する権限・構成などの条件も照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データの対象範囲：Junos OS — 21.3以上 かつ 21.3R3-S5未満（環境: EX Series / SRX Series）。この範囲に加え、下に記載する権限・構成などの条件も照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データの対象範囲：Junos OS — 21.4以上 かつ 21.4R3-S5未満（環境: EX Series / SRX Series）。この範囲に加え、下に記載する権限・構成などの条件も照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データの対象範囲：Junos OS — 22.1以上 かつ 22.1R3-S4未満（環境: EX Series / SRX Series）。この範囲に加え、下に記載する権限・構成などの条件も照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データの対象範囲：Junos OS — 22.2以上 かつ 22.2R3-S2未満（環境: EX Series / SRX Series）。この範囲に加え、下に記載する権限・構成などの条件も照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データの対象範囲：Junos OS — 22.3以上 かつ 22.3R2-S2未満, 22.3R3-S1（環境: EX Series / SRX Series）。この範囲に加え、下に記載する権限・構成などの条件も照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データの対象範囲：Junos OS — 22.4以上 かつ 22.4R2-S1未満, 22.4R3（環境: EX Series / SRX Series）。この範囲に加え、下に記載する権限・構成などの条件も照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データの対象範囲：Junos OS — 23以上,2 かつ 23.2R1-S1未満, 23.2R2（環境: EX Series / SRX Series）。この範囲に加え、下に記載する権限・構成などの条件も照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公開データにある構成上の条件：対象環境・機能: EX Series / SRX Series。製品バージョンだけでなく、原文の利用条件を照合してください。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "公表されたCVSS評価では、攻撃前に対象システムの権限を持っている必要はありません。他の構成・機能の条件まで不要という意味ではありません。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845", "https://www.first.org/cvss/v3.1/specification-document" ] }, { "text": "公表されたCVSS評価では、ネットワーク越しに攻撃が届く経路があります。あなたの環境がインターネットから到達可能かどうかは、公開設定を別に確認する必要があります。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845", "https://www.first.org/cvss/v3.1/specification-document" ] }, { "text": "公表されたCVSS評価では、攻撃者以外の利用者がリンクを開くなどの操作をしなくても、攻撃が成立し得ます。", "kind": "fact", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845", "https://www.first.org/cvss/v3.1/specification-document" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。利用している場合は、対象かどうかの確認と修正を優先してください。あなたの環境がすでに被害を受けたことを示す情報ではありません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845" ] } ], "versionChecks": [ { "text": "「Junos OS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] } ], "actions": [ { "text": "「CVE-2023-36845」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] } ], "verification": [ { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36845", "https://supportportal.juniper.net/JSA72300", "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36845" ] } ], "unknowns": [ "取り込んだ公開データには、修正済みと明記されたバージョン番号がありません。「修正されていない」と確定したわけではありません。下の問い合わせ文で、修正版の番号・提供場所・適用予定を確認できます。" ], "supportRequest": "件名：CVE-2023-36845（Junos OS）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2023-36845について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-36845", "sources": [ { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36845", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "label": "CISA KEV（悪用確認）" }, { "url": "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36845", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "glossary": [], "automation": { "status": "error", "lastAttempt": "2026-10-24T23:55:54.884Z", "lastSuccess": "2026-10-23T03:32:44.736Z", "sourceCheckedAt": "2026-10-24T23:55:54.884Z", "errorCode": "validation_failed" } } }, { "id": "CVE-2023-36846", "aliases": [], "title": "Junos OS：脆弱性情報", "summary": "Juniper Networks の Junos OS（SRX シリーズ）において、認証が不要な user.php への特定リクエストを利用し、J‑Web から任意のファイルをアップロードできる脆弱性が存在します。この脆弱性により、ファイルシステムの一部の完全性が失われ、他の脆弱性と組み合わせて利用される可能性があります。", "risk": "ファイルシステムの一部の完全性が失われるという限定的な影響があります。", "product": "Junos OS", "category": "other", "component": "package", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "juniper", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Junos OS", "range": "< 20.4R3-S8（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 21.1 / < 21.1*（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 21.2 / < 21.2R3-S6（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 21.3 / < 21.3R3-S5（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 21.4 / < 21.4R3-S5（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 22.1 / < 22.1R3-S3（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 22.2 / < 22.2R3-S2（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 22.3 / < 22.3R2-S2, 22.3R3（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 22.4 / < 22.4R2-S1, 22.4R3（環境: SRX Series）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "label": "CVE：juniper" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36846", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36846", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE掲載の参考情報" }, { "url": "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36846", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-08-17T19:18:00.406Z", "modifiedAt": "2025-10-21T23:05:40.458Z", "fetchedAt": "2026-10-24T05:24:11.069Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n * All versions prior to 20.4R3-S8;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S6;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S3;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.", "sourceTitle": "Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "platforms": [ "SRX Series" ], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [ { "lessThan": "20.4R3-S8", "status": "affected", "version": "0", "versionType": "semver" }, { "lessThan": "21.1*", "status": "affected", "version": "21.1", "versionType": "semver" }, { "lessThan": "21.2R3-S6", "status": "affected", "version": "21.2", "versionType": "semver" }, { "lessThan": "21.3R3-S5", "status": "affected", "version": "21.3", "versionType": "semver" }, { "lessThan": "21.4R3-S5", "status": "affected", "version": "21.4", "versionType": "semver" }, { "lessThan": "22.1R3-S3", "status": "affected", "version": "22.1", "versionType": "semver" }, { "lessThan": "22.2R3-S2", "status": "affected", "version": "22.2", "versionType": "semver" }, { "lessThan": "22.3R2-S2, 22.3R3", "status": "affected", "version": "22.3", "versionType": "semver" }, { "lessThan": "22.4R2-S1, 22.4R3", "status": "affected", "version": "22.4", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: SRX Series。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-36846", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "fetchedAt": "2026-10-24T05:24:11.069Z", "publishedAt": "2023-08-17T19:18:00.406Z", "modifiedAt": "2025-10-21T23:05:40.458Z", "state": "published", "provider": "juniper", "title": "Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files", "descriptions": [ { "lang": "en", "value": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n * All versions prior to 20.4R3-S8;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S6;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S3;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36846", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Juniper Networks", "product": "Junos OS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [ "SRX Series" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "20.4R3-S8", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "21.1", "lessThan": "21.1*", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "21.2", "lessThan": "21.2R3-S6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "21.3", "lessThan": "21.3R3-S5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "21.4", "lessThan": "21.4R3-S5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "22.1", "lessThan": "22.1R3-S3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "22.2", "lessThan": "22.2R3-S2", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "22.3", "lessThan": "22.3R2-S2, 22.3R3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "22.4", "lessThan": "22.4R2-S1, 22.4R3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "The following software releases have been updated to resolve this specific issue: \n\n20.4R3-S8, 21.2R3-S6, 21.3R3-S5*, 21.4R3-S5*, 22.1R3-S3, 22.2R3-S2, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3*, 23.2R1, and all subsequent releases.\n*Pending Publication", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "Disable J-Web, or limit access to only trusted hosts.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [ { "lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-306", "lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "juniper", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE", "tags": [ "vendor-advisory", "mitigation", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36846", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"SRX Series\"],\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"20.4R3-S8\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"21.1*\",\"status\":\"affected\",\"version\":\"21.1\",\"versionType\":\"semver\"},{\"lessThan\":\"21.2R3-S6\",\"status\":\"affected\",\"version\":\"21.2\",\"versionType\":\"semver\"},{\"lessThan\":\"21.3R3-S5\",\"status\":\"affected\",\"version\":\"21.3\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S5\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.1R3-S3\",\"status\":\"affected\",\"version\":\"22.1\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S2\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.3R2-S2, 22.3R3\",\"status\":\"affected\",\"version\":\"22.3\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R2-S1, 22.4R3\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n * All versions prior to 20.4R3-S8;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S6;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S3;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "The following software releases have been updated to resolve this specific issue: \n\n20.4R3-S8, 21.2R3-S6, 21.3R3-S5*, 21.4R3-S5*, 22.1R3-S3, 22.2R3-S2, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3*, 23.2R1, and all subsequent releases.\n*Pending Publication", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "Disable J-Web, or limit access to only trusted hosts.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-306\",\"description\":\"CWE-306 Missing Authentication for Critical Function\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-36846:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36846", "sourcePath": "retained:/originalText", "text": "Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-36846:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36846", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36846", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:40.458Z", "fetchedAt": "2026-10-24T05:24:11.069Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Junos OSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:24:11.069Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e4bec7efbe0db001f1b253d1a1c563005623b63d9952f43535eac647bbf92359", "sourceModifiedAt": "2025-10-21T23:05:40.458Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Juniper Networks の Junos OS（SRX シリーズ）において、認証が不要な user.php への特定リクエストを利用し、J‑Web から任意のファイルをアップロードできる脆弱性が存在します。この脆弱性により、ファイルシステムの一部の完全性が失われ、他の脆弱性と組み合わせて利用される可能性があります。", "risk": "ファイルシステムの一部の完全性が失われるという限定的な影響があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "ネットワーク上の認証されていない攻撃者が、認証不要な user.php へのリクエストを送信できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "J‑Web が有効であり、攻撃者が任意のファイルをアップロードできること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Juniper Networks / Junos OS。影響ありとして記載：20.4R3-S8未満の版。影響ありとして記載：21.1以上、21.1*未満。影響ありとして記載：21.2以上、21.2R3-S6未満。影響ありとして記載：21.3以上、21.3R3-S5未満。影響ありとして記載：21.4以上、21.4R3-S5未満。影響ありとして記載：22.1以上、22.1R3-S3未満。影響ありとして記載：22.2以上、22.2R3-S2未満。影響ありとして記載：22.3以上、22.3R2-S2, 22.3R3未満。影響ありとして記載：22.4以上、22.4R2-S1, 22.4R3未満。対象の環境：SRX Series", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36846" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Junos OS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36846", "https://supportportal.juniper.net/JSA72300", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36846", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36846" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "J‑Web を無効化するか、信頼できるホストからのみアクセスできるよう制限してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json" ], "evidenceIds": [ "E4" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36846", "https://supportportal.juniper.net/JSA72300", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36846", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36846" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "label": "CVE：juniper" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36846", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36846", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE掲載の参考情報" }, { "url": "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36846", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n * All versions prior to 20.4R3-S8;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S6;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S5;\n * 22.1 versions \n\nprior to \n\n22.1R3-S3;\n * 22.2 versions \n\nprior to \n\n22.2R3-S2;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourceField": "/containers/cna/title", "excerpt": "Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"SRX Series\"],\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"20.4R3-S8\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"21.1*\",\"status\":\"affected\",\"version\":\"21.1\",\"versionType\":\"semver\"},{\"lessThan\":\"21.2R3-S6\",\"status\":\"affected\",\"version\":\"21.2\",\"versionType\":\"semver\"},{\"lessThan\":\"21.3R3-S5\",\"status\":\"affected\",\"version\":\"21.3\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S5\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.1R3-S3\",\"status\":\"affected\",\"version\":\"22.1\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S2\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.3R2-S2, 22.3R3\",\"status\":\"affected\",\"version\":\"22.3\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R2-S1, 22.4R3\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36846.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "Disable J-Web, or limit access to only trusted hosts.", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36846", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-36846\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-36846（Junos OS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ネットワーク上の認証されていない攻撃者が、認証不要な user.php へのリクエストを送信できること。\n・J‑Web が有効であり、攻撃者が任意のファイルをアップロードできること。\n・公式の対象表：Juniper Networks / Junos OS。影響ありとして記載：20.4R3-S8未満の版。影響ありとして記載：21.1以上、21.1*未満。影響ありとして記載：21.2以上、21.2R3-S6未満。影響ありとして記載：21.3以上、21.3R3-S5未満。影響ありとして記載：21.4以上、21.4R3-S5未満。影響ありとして記載：22.1以上、22.1R3-S3未満。影響ありとして記載：22.2以上、22.2R3-S2未満。影響ありとして記載：22.3以上、22.3R2-S2, 22.3R3未満。影響ありとして記載：22.4以上、22.4R2-S1, 22.4R3未満。対象の環境：SRX Series\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-36846", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:24:11.069Z", "lastSuccess": "2026-10-24T05:24:11.069Z", "sourceCheckedAt": "2026-10-24T05:24:11.069Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-36847", "aliases": [], "title": "Junos OS：脆弱性情報", "summary": "Juniper Networks の Junos OS（EX シリーズ）において、認証が不要な重要機能の欠如により、ネットワーク上の認証されていない攻撃者が J‑Web を通じて任意のファイルをアップロードでき、ファイルシステムの一部の完全性が失われ、他の脆弱性への連鎖が可能になる。", "risk": "ファイルシステムの一部の完全性が失われるという限定的な影響が生じる。", "product": "Junos OS", "category": "other", "component": "package", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "juniper", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Junos OS", "range": "< 20.4R3-S8（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 21.1 / < 21.1*（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 21.2 / < 21.2R3-S6（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 21.3 / < 21.3R3-S5（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 21.4 / < 21.4R3-S4（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 22.1 / < 22.1R3-S3（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 22.2 / < 22.2R3-S1（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 22.3 / < 22.3R2-S2, 22.3R3（環境: EX Series）" }, { "product": "Junos OS", "range": ">= 22.4 / < 22.4R2-S1, 22.4R3（環境: EX Series）" } ], "fixed": [], "steps": [ "以下のソフトウェアリリースで本問題が修正されています：20.4R3‑S8、21.2R3‑S6、21.3R3‑S5（公開保留中）、21.4R3‑S4、22.1R3‑S3、22.2R3‑S1、22.3R2‑S2、22.3R3、22.4R2‑S1、22.4R3（公開保留中）、23.2R1、以降のすべてのリリース。", "「CVE-2023-36847」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "label": "CVE：juniper" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36847", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE掲載の参考情報" }, { "url": "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36847", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-08-17T19:16:53.657Z", "modifiedAt": "2025-10-21T23:05:40.988Z", "fetchedAt": "2026-10-24T05:25:53.054Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\n\n\nWith a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n * All versions prior to 20.4R3-S8;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S6;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S4;\n * 22.1 versions \n\nprior to \n\n22.1R3-S3;\n * 22.2 versions \n\nprior to \n\n22.2R3-S1;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.", "sourceTitle": "Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "platforms": [ "EX Series" ], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [ { "lessThan": "20.4R3-S8", "status": "affected", "version": "0", "versionType": "semver" }, { "lessThan": "21.1*", "status": "affected", "version": "21.1", "versionType": "semver" }, { "lessThan": "21.2R3-S6", "status": "affected", "version": "21.2", "versionType": "semver" }, { "lessThan": "21.3R3-S5", "status": "affected", "version": "21.3", "versionType": "semver" }, { "lessThan": "21.4R3-S4", "status": "affected", "version": "21.4", "versionType": "semver" }, { "lessThan": "22.1R3-S3", "status": "affected", "version": "22.1", "versionType": "semver" }, { "lessThan": "22.2R3-S1", "status": "affected", "version": "22.2", "versionType": "semver" }, { "lessThan": "22.3R2-S2, 22.3R3", "status": "affected", "version": "22.3", "versionType": "semver" }, { "lessThan": "22.4R2-S1, 22.4R3", "status": "affected", "version": "22.4", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: EX Series。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-36847", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "fetchedAt": "2026-10-24T05:25:53.054Z", "publishedAt": "2023-08-17T19:16:53.657Z", "modifiedAt": "2025-10-21T23:05:40.988Z", "state": "published", "provider": "juniper", "title": "Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files", "descriptions": [ { "lang": "en", "value": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\n\n\nWith a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n * All versions prior to 20.4R3-S8;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S6;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S4;\n * 22.1 versions \n\nprior to \n\n22.1R3-S3;\n * 22.2 versions \n\nprior to \n\n22.2R3-S1;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Juniper Networks", "product": "Junos OS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [ "EX Series" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "20.4R3-S8", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "21.1", "lessThan": "21.1*", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "21.2", "lessThan": "21.2R3-S6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "21.3", "lessThan": "21.3R3-S5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "21.4", "lessThan": "21.4R3-S4", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "22.1", "lessThan": "22.1R3-S3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "22.2", "lessThan": "22.2R3-S1", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "22.3", "lessThan": "22.3R2-S2, 22.3R3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "22.4", "lessThan": "22.4R2-S1, 22.4R3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "The following software releases have been updated to resolve this specific issue: \n\n20.4R3-S8, 21.2R3-S6, 21.3R3-S5*, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3*, 23.2R1, and all subsequent releases.\n*Pending Publication", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "Disable J-Web, or limit access to only trusted hosts.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [ { "lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-306", "lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "juniper", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE", "tags": [ "vendor-advisory", "mitigation", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36847", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"EX Series\"],\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"20.4R3-S8\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"21.1*\",\"status\":\"affected\",\"version\":\"21.1\",\"versionType\":\"semver\"},{\"lessThan\":\"21.2R3-S6\",\"status\":\"affected\",\"version\":\"21.2\",\"versionType\":\"semver\"},{\"lessThan\":\"21.3R3-S5\",\"status\":\"affected\",\"version\":\"21.3\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S4\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.1R3-S3\",\"status\":\"affected\",\"version\":\"22.1\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S1\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.3R2-S2, 22.3R3\",\"status\":\"affected\",\"version\":\"22.3\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R2-S1, 22.4R3\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\n\n\nWith a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n * All versions prior to 20.4R3-S8;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S6;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S4;\n * 22.1 versions \n\nprior to \n\n22.1R3-S3;\n * 22.2 versions \n\nprior to \n\n22.2R3-S1;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "The following software releases have been updated to resolve this specific issue: \n\n20.4R3-S8, 21.2R3-S6, 21.3R3-S5*, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3*, 23.2R1, and all subsequent releases.\n*Pending Publication", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "Disable J-Web, or limit access to only trusted hosts.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-306\",\"description\":\"CWE-306 Missing Authentication for Critical Function\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-36847:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "sourcePath": "retained:/originalText", "text": "Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-36847:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:40.988Z", "fetchedAt": "2026-10-24T05:25:53.054Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Junos OSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:25:53.054Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d69cbcb2c1afa41a05b7a6937d067d36361f9f593ef90e15cd6f8eda817d663e", "sourceModifiedAt": "2025-10-21T23:05:40.988Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Juniper Networks の Junos OS（EX シリーズ）において、認証が不要な重要機能の欠如により、ネットワーク上の認証されていない攻撃者が J‑Web を通じて任意のファイルをアップロードでき、ファイルシステムの一部の完全性が失われ、他の脆弱性への連鎖が可能になる。", "risk": "ファイルシステムの一部の完全性が失われるという限定的な影響が生じる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "ネットワーク上の認証されていない攻撃者が、認証を要求しない installAppPackage.php への特定リクエストを使用して J‑Web から任意のファイルをアップロードできること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "J‑Web インターフェースが有効化されていることが前提となる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Juniper Networks / Junos OS。影響ありとして記載：20.4R3-S8未満の版。影響ありとして記載：21.1以上、21.1*未満。影響ありとして記載：21.2以上、21.2R3-S6未満。影響ありとして記載：21.3以上、21.3R3-S5未満。影響ありとして記載：21.4以上、21.4R3-S4未満。影響ありとして記載：22.1以上、22.1R3-S3未満。影響ありとして記載：22.2以上、22.2R3-S1未満。影響ありとして記載：22.3以上、22.3R2-S2, 22.3R3未満。影響ありとして記載：22.4以上、22.4R2-S1, 22.4R3未満。対象の環境：EX Series", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Junos OS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36847", "https://supportportal.juniper.net/JSA72300", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36847" ] } ], "actions": [ { "text": "以下のソフトウェアリリースで本問題が修正されています：20.4R3‑S8、21.2R3‑S6、21.3R3‑S5（公開保留中）、21.4R3‑S4、22.1R3‑S3、22.2R3‑S1、22.3R2‑S2、22.3R3、22.4R2‑S1、22.4R3（公開保留中）、23.2R1、以降のすべてのリリース。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2023-36847」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36847", "https://supportportal.juniper.net/JSA72300", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36847" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36847", "https://supportportal.juniper.net/JSA72300", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36847" ] } ], "temporaryMitigations": [ { "text": "J‑Web を無効化するか、信頼できるホストのみにアクセスを制限する。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json" ], "evidenceIds": [ "E5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36847", "https://supportportal.juniper.net/JSA72300", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36847" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "label": "CVE：juniper" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36847", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE掲載の参考情報" }, { "url": "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36847", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\n\n\nWith a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n * All versions prior to 20.4R3-S8;\n * 21.1 versions 21.1R1 and later;\n * 21.2 versions prior to 21.2R3-S6;\n * 21.3 versions \n\nprior to \n\n 21.3R3-S5;\n * 21.4 versions \n\nprior to \n\n21.4R3-S4;\n * 22.1 versions \n\nprior to \n\n22.1R3-S3;\n * 22.2 versions \n\nprior to \n\n22.2R3-S1;\n * 22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n * 22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourceField": "/containers/cna/title", "excerpt": "Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"EX Series\"],\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"20.4R3-S8\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"21.1*\",\"status\":\"affected\",\"version\":\"21.1\",\"versionType\":\"semver\"},{\"lessThan\":\"21.2R3-S6\",\"status\":\"affected\",\"version\":\"21.2\",\"versionType\":\"semver\"},{\"lessThan\":\"21.3R3-S5\",\"status\":\"affected\",\"version\":\"21.3\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S4\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.1R3-S3\",\"status\":\"affected\",\"version\":\"22.1\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S1\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.3R2-S2, 22.3R3\",\"status\":\"affected\",\"version\":\"22.3\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R2-S1, 22.4R3\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "The following software releases have been updated to resolve this specific issue: \n\n20.4R3-S8, 21.2R3-S6, 21.3R3-S5*, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3*, 23.2R1, and all subsequent releases.\n*Pending Publication", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36847.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "Disable J-Web, or limit access to only trusted hosts.", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36847", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-36847\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-36847（Junos OS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ネットワーク上の認証されていない攻撃者が、認証を要求しない installAppPackage.php への特定リクエストを使用して J‑Web から任意のファイルをアップロードできること。\n・J‑Web インターフェースが有効化されていることが前提となる。\n・公式の対象表：Juniper Networks / Junos OS。影響ありとして記載：20.4R3-S8未満の版。影響ありとして記載：21.1以上、21.1*未満。影響ありとして記載：21.2以上、21.2R3-S6未満。影響ありとして記載：21.3以上、21.3R3-S5未満。影響ありとして記載：21.4以上、21.4R3-S4未満。影響ありとして記載：22.1以上、22.1R3-S3未満。影響ありとして記載：22.2以上、22.2R3-S1未満。影響ありとして記載：22.3以上、22.3R2-S2, 22.3R3未満。影響ありとして記載：22.4以上、22.4R2-S1, 22.4R3未満。対象の環境：EX Series\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-36847", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:25:53.054Z", "lastSuccess": "2026-10-24T05:25:53.054Z", "sourceCheckedAt": "2026-10-24T05:25:53.054Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-36851", "aliases": [], "title": "Junos OS：脆弱性情報", "summary": "Juniper Networks Junos OSのSRXシリーズにおいて、認証が不要な重要機能の欠如により、ネットワーク経由の認証されていない攻撃者が webauth_operation.php への特定リクエストを利用してJ‑Webを通じ任意のファイルをアップロード・ダウンロードでき、ファイルシステムの完全性または機密性に影響を与える可能性があります。", "risk": "ファイルシステムの完全性が失われ、機密情報が漏洩する可能性があります。", "product": "Junos OS", "category": "other", "component": "package", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "juniper", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Junos OS", "range": ">= 21.2 / < 21.2R3-S8（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 21.4 / < 21.4R3-S6（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 22.1 / < 22.1R3-S5（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 22.2 / < 22.2R3-S3（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 22.3 / < 22.3R3-S2（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 22.4 / < 22.4R2-S2, 22.4R3（環境: SRX Series）" }, { "product": "Junos OS", "range": ">= 23.2 / < 23.2R1-S2, 23.2R2（環境: SRX Series）" } ], "fixed": [], "steps": [ "提供されたソフトウェアリリース（例：21.2R3‑S8、21.4R3‑S6、22.1R3‑S5 など）に更新して本脆弱性を解消する。", "「CVE-2023-36851」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "label": "CVE：juniper" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36851", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE掲載の参考情報" }, { "url": "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36851", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-09-26T19:53:17.080Z", "modifiedAt": "2025-10-21T23:05:36.801Z", "fetchedAt": "2026-10-24T08:04:38.829Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to \n\nwebauth_operation.php\n\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \n\nintegrity or confidentiality, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n * \n\n21.2 versions prior to 21.2R3-S8;\n * 21.4 \n\nversions prior to \n\n21.4R3-S6;\n * 22.1 \n\nversions prior to \n\n22.1R3-S5;\n * 22.2 \n\nversions prior to \n\n22.2R3-S3;\n * 22.3 \n\nversions prior to \n\n22.3R3-S2;\n * 22.4 versions prior to 22,4R2-S2, 22.4R3;\n * 23.2 versions prior to \n\n23.2R1-S2, 23.2R2.", "sourceTitle": "Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "platforms": [ "SRX Series" ], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [ { "lessThan": "21.2R3-S8", "status": "affected", "version": "21.2", "versionType": "semver" }, { "lessThan": "21.4R3-S6", "status": "affected", "version": "21.4", "versionType": "semver" }, { "lessThan": "22.1R3-S5", "status": "affected", "version": "22.1", "versionType": "semver" }, { "lessThan": "22.2R3-S3", "status": "affected", "version": "22.2", "versionType": "semver" }, { "lessThan": "22.3R3-S2", "status": "affected", "version": "22.3", "versionType": "semver" }, { "lessThan": "22.4R2-S2, 22.4R3", "status": "affected", "version": "22.4", "versionType": "semver" }, { "lessThan": "23.2R1-S2, 23.2R2", "status": "affected", "version": "23.2", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: SRX Series。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-36851", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "fetchedAt": "2026-10-24T08:04:38.829Z", "publishedAt": "2023-09-26T19:53:17.080Z", "modifiedAt": "2025-10-21T23:05:36.801Z", "state": "published", "provider": "juniper", "title": "Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files", "descriptions": [ { "lang": "en", "value": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to \n\nwebauth_operation.php\n\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \n\nintegrity or confidentiality, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n * \n\n21.2 versions prior to 21.2R3-S8;\n * 21.4 \n\nversions prior to \n\n21.4R3-S6;\n * 22.1 \n\nversions prior to \n\n22.1R3-S5;\n * 22.2 \n\nversions prior to \n\n22.2R3-S3;\n * 22.3 \n\nversions prior to \n\n22.3R3-S2;\n * 22.4 versions prior to 22,4R2-S2, 22.4R3;\n * 23.2 versions prior to \n\n23.2R1-S2, 23.2R2.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Juniper Networks", "product": "Junos OS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [ "SRX Series" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "21.2", "lessThan": "21.2R3-S8", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "21.4", "lessThan": "21.4R3-S6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "22.1", "lessThan": "22.1R3-S5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "22.2", "lessThan": "22.2R3-S3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "22.3", "lessThan": "22.3R3-S2", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "22.4", "lessThan": "22.4R2-S2, 22.4R3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "23.2", "lessThan": "23.2R1-S2, 23.2R2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "The following software releases have been updated to resolve this specific issue: 21.2R3-S8*, 21.4R3-S6*, 22.1R3-S5*, 22.2R3-S3*, 22.3R3-S2*, 22.4R2-S2, 22.4R3*, 23.2R1-S2, 23.2R2*, 23.4R1, and all subsequent releases.\n*Pending Publication", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "Disable J-Web, or limit access to only trusted hosts.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [ { "lang": "en", "value": "While Juniper SIRT is not aware of a successful exploit against a customer, a proof of concept has been published and exploit attempts have been detected.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-306", "lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "juniper", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE", "tags": [ "vendor-advisory", "mitigation", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36851", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"SRX Series\"],\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"21.2R3-S8\",\"status\":\"affected\",\"version\":\"21.2\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S6\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.1R3-S5\",\"status\":\"affected\",\"version\":\"22.1\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S3\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.3R3-S2\",\"status\":\"affected\",\"version\":\"22.3\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R2-S2, 22.4R3\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"},{\"lessThan\":\"23.2R1-S2, 23.2R2\",\"status\":\"affected\",\"version\":\"23.2\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to \n\nwebauth_operation.php\n\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \n\nintegrity or confidentiality, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n * \n\n21.2 versions prior to 21.2R3-S8;\n * 21.4 \n\nversions prior to \n\n21.4R3-S6;\n * 22.1 \n\nversions prior to \n\n22.1R3-S5;\n * 22.2 \n\nversions prior to \n\n22.2R3-S3;\n * 22.3 \n\nversions prior to \n\n22.3R3-S2;\n * 22.4 versions prior to 22,4R2-S2, 22.4R3;\n * 23.2 versions prior to \n\n23.2R1-S2, 23.2R2.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "The following software releases have been updated to resolve this specific issue: 21.2R3-S8*, 21.4R3-S6*, 22.1R3-S5*, 22.2R3-S3*, 22.3R3-S2*, 22.4R2-S2, 22.4R3*, 23.2R1-S2, 23.2R2*, 23.4R1, and all subsequent releases.\n*Pending Publication", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "Disable J-Web, or limit access to only trusted hosts.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "While Juniper SIRT is not aware of a successful exploit against a customer, a proof of concept has been published and exploit attempts have been detected.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-306\",\"description\":\"CWE-306 Missing Authentication for Critical Function\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-36851:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "sourcePath": "retained:/originalText", "text": "Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-36851:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:36.801Z", "fetchedAt": "2026-10-24T08:04:38.829Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Junos OSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T08:04:38.829Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "79c66c36a550a898cd84b14a8152145a5d2c0c81a6f8f0adedf0617da7d3d921", "sourceModifiedAt": "2025-10-21T23:05:36.801Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Juniper Networks Junos OSのSRXシリーズにおいて、認証が不要な重要機能の欠如により、ネットワーク経由の認証されていない攻撃者が webauth_operation.php への特定リクエストを利用してJ‑Webを通じ任意のファイルをアップロード・ダウンロードでき、ファイルシステムの完全性または機密性に影響を与える可能性があります。", "risk": "ファイルシステムの完全性が失われ、機密情報が漏洩する可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "認証されていないネットワークベースの攻撃者が、認証不要の webauth_operation.php へのリクエストを送信できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "J‑Web が有効で、攻撃者がそのインターフェースにアクセスできること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "対象は Junos OS がインストールされた SRX シリーズのデバイスであること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Juniper Networks / Junos OS。影響ありとして記載：21.2以上、21.2R3-S8未満。影響ありとして記載：21.4以上、21.4R3-S6未満。影響ありとして記載：22.1以上、22.1R3-S5未満。影響ありとして記載：22.2以上、22.2R3-S3未満。影響ありとして記載：22.3以上、22.3R3-S2未満。影響ありとして記載：22.4以上、22.4R2-S2, 22.4R3未満。影響ありとして記載：23.2以上、23.2R1-S2, 23.2R2未満。対象の環境：SRX Series", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851" ], "evidenceIds": [ "E7" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json" ], "evidenceIds": [ "E4" ] }, { "text": "「Junos OS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36851", "https://supportportal.juniper.net/JSA72300", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36851" ] } ], "actions": [ { "text": "提供されたソフトウェアリリース（例：21.2R3‑S8、21.4R3‑S6、22.1R3‑S5 など）に更新して本脆弱性を解消する。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json" ], "evidenceIds": [ "E5" ] }, { "text": "「CVE-2023-36851」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-36851", "https://supportportal.juniper.net/JSA72300", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36851" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36851", "https://supportportal.juniper.net/JSA72300", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36851" ] } ], "temporaryMitigations": [ { "text": "J‑Web を無効化するか、信頼できるホストのみにアクセスを制限する。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json" ], "evidenceIds": [ "E6" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-36851", "https://supportportal.juniper.net/JSA72300", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2023-36851" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "label": "CVE：juniper" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-36851", "label": "CVE公式レコード" }, { "url": "https://supportportal.juniper.net/JSA72300", "label": "CVE掲載の参考情報" }, { "url": "https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36851", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to \n\nwebauth_operation.php\n\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \n\nintegrity or confidentiality, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n * \n\n21.2 versions prior to 21.2R3-S8;\n * 21.4 \n\nversions prior to \n\n21.4R3-S6;\n * 22.1 \n\nversions prior to \n\n22.1R3-S5;\n * 22.2 \n\nversions prior to \n\n22.2R3-S3;\n * 22.3 \n\nversions prior to \n\n22.3R3-S2;\n * 22.4 versions prior to 22,4R2-S2, 22.4R3;\n * 23.2 versions prior to \n\n23.2R1-S2, 23.2R2.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourceField": "/containers/cna/title", "excerpt": "Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "sourceField": "retained:/originalText", "excerpt": "Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"platforms\":[\"SRX Series\"],\"product\":\"Junos OS\",\"vendor\":\"Juniper Networks\",\"versions\":[{\"lessThan\":\"21.2R3-S8\",\"status\":\"affected\",\"version\":\"21.2\",\"versionType\":\"semver\"},{\"lessThan\":\"21.4R3-S6\",\"status\":\"affected\",\"version\":\"21.4\",\"versionType\":\"semver\"},{\"lessThan\":\"22.1R3-S5\",\"status\":\"affected\",\"version\":\"22.1\",\"versionType\":\"semver\"},{\"lessThan\":\"22.2R3-S3\",\"status\":\"affected\",\"version\":\"22.2\",\"versionType\":\"semver\"},{\"lessThan\":\"22.3R3-S2\",\"status\":\"affected\",\"version\":\"22.3\",\"versionType\":\"semver\"},{\"lessThan\":\"22.4R2-S2, 22.4R3\",\"status\":\"affected\",\"version\":\"22.4\",\"versionType\":\"semver\"},{\"lessThan\":\"23.2R1-S2, 23.2R2\",\"status\":\"affected\",\"version\":\"23.2\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "The following software releases have been updated to resolve this specific issue: 21.2R3-S8*, 21.4R3-S6*, 22.1R3-S5*, 22.2R3-S3*, 22.3R3-S2*, 22.4R2-S2, 22.4R3*, 23.2R1-S2, 23.2R2*, 23.4R1, and all subsequent releases.\n*Pending Publication", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36851.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "Disable J-Web, or limit access to only trusted hosts.", "language": "en", "representation": "source_excerpt" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36851", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-36851\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-36851（Junos OS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていないネットワークベースの攻撃者が、認証不要の webauth_operation.php へのリクエストを送信できること。\n・J‑Web が有効で、攻撃者がそのインターフェースにアクセスできること。\n・対象は Junos OS がインストールされた SRX シリーズのデバイスであること。\n・公式の対象表：Juniper Networks / Junos OS。影響ありとして記載：21.2以上、21.2R3-S8未満。影響ありとして記載：21.4以上、21.4R3-S6未満。影響ありとして記載：22.1以上、22.1R3-S5未満。影響ありとして記載：22.2以上、22.2R3-S3未満。影響ありとして記載：22.3以上、22.3R3-S2未満。影響ありとして記載：22.4以上、22.4R2-S2, 22.4R3未満。影響ありとして記載：23.2以上、23.2R1-S2, 23.2R2未満。対象の環境：SRX Series\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-36851", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T08:04:38.829Z", "lastSuccess": "2026-10-24T08:04:38.829Z", "sourceCheckedAt": "2026-10-24T08:04:38.829Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-47246", "aliases": [], "title": "n/a：ファイルへの不正アクセス", "summary": "SysAid On-Premise の 23.3.36 未満のバージョンでは、パス・トラバーサルにより攻撃者が Tomcat のウェブルートにファイルを書き込むことでコード実行が可能になる脆弱性があり、2023 年 11 月に実際に悪用されています。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性があります。", "product": "SysAid SysAid Server", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2023-47246」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-47246", "label": "CVE公式レコード" }, { "url": "https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023", "label": "CVE掲載の参考情報" }, { "url": "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification", "label": "CISAが示す関連情報" }, { "url": "https://documentation.sysaid.com/docs/latest-version-installation-files", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47246", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-11-10T00:00:00.000Z", "modifiedAt": "2026-07-31T03:55:29.410Z", "fetchedAt": "2026-10-24T06:23:24.979Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-47246", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json", "fetchedAt": "2026-10-24T06:23:24.979Z", "publishedAt": "2023-11-10T00:00:00.000Z", "modifiedAt": "2026-07-31T03:55:29.410Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://documentation.sysaid.com/docs/latest-version-installation-files", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47246", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"text\",\"lang\":\"en\",\"description\":\"n/a\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-47246:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "sourcePath": "retained:/originalText", "text": "SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-47246:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T06:17:49.270Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-31T03:55:29.410Z", "fetchedAt": "2026-10-24T06:23:24.979Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-13T00:00:00.000Z", "fetchedAt": "2026-10-24T06:17:49.270Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:23:24.979Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "dda925b131b6aec4fafd25d5c3c9cc163967afd5a1af0459655062f2c7168270", "sourceModifiedAt": "2026-07-31T03:55:29.410Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SysAid On-Premise の 23.3.36 未満のバージョンでは、パス・トラバーサルにより攻撃者が Tomcat のウェブルートにファイルを書き込むことでコード実行が可能になる脆弱性があり、2023 年 11 月に実際に悪用されています。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象製品は SysAid Server のオンプレミス版です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json" ], "evidenceIds": [ "E1" ] }, { "text": "影響を受けるバージョンは 23.3.36 未満です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者がパス・トラバーサルを利用して Tomcat のウェブルートに任意のファイルを書き込めることが前提条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json" ], "evidenceIds": [ "E1" ] }, { "text": "この脆弱性は 2023 年 11 月に実際に悪用されたことが確認されています。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json" ], "evidenceIds": [ "E4" ] }, { "text": "「SysAid SysAid Server」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-47246", "https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023", "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification", "https://documentation.sysaid.com/docs/latest-version-installation-files", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "https://nvd.nist.gov/vuln/detail/CVE-2023-47246" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246" ], "evidenceIds": [ "E5", "E6" ] }, { "text": "「CVE-2023-47246」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-47246", "https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023", "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification", "https://documentation.sysaid.com/docs/latest-version-installation-files", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "https://nvd.nist.gov/vuln/detail/CVE-2023-47246" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-47246", "https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023", "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification", "https://documentation.sysaid.com/docs/latest-version-installation-files", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "https://nvd.nist.gov/vuln/detail/CVE-2023-47246" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-47246", "https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023", "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification", "https://documentation.sysaid.com/docs/latest-version-installation-files", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "https://nvd.nist.gov/vuln/detail/CVE-2023-47246" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-47246", "https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023", "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification", "https://documentation.sysaid.com/docs/latest-version-installation-files", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "https://nvd.nist.gov/vuln/detail/CVE-2023-47246" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-47246", "label": "CVE公式レコード" }, { "url": "https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023", "label": "CVE掲載の参考情報" }, { "url": "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification", "label": "CISAが示す関連情報" }, { "url": "https://documentation.sysaid.com/docs/latest-version-installation-files", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47246", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "sourceField": "retained:/originalText", "excerpt": "SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-47246\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/47xxx/CVE-2023-47246.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-47246", "sourceField": "/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null } ], "supportRequest": "件名：CVE-2023-47246（SysAid SysAid Server）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は SysAid Server のオンプレミス版です。\n・影響を受けるバージョンは 23.3.36 未満です。\n・攻撃者がパス・トラバーサルを利用して Tomcat のウェブルートに任意のファイルを書き込めることが前提条件です。\n・この脆弱性は 2023 年 11 月に実際に悪用されたことが確認されています。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-47246", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:23:24.979Z", "lastSuccess": "2026-10-24T06:23:24.979Z", "sourceCheckedAt": "2026-10-24T06:23:24.979Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-29552", "aliases": [], "title": "n/a：サービス停止", "summary": "Service Location Protocol (SLP) は、認証されていないリモート攻撃者が任意のサービスを登録できるため、偽装した UDP トラフィックを利用して大きな増幅効果を伴うサービス拒否 (DoS) 攻撃を実行できる可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、対象システムに対してサービス拒否 (DoS) 攻撃が行われ、正常なサービスが利用できなくなる恐れがあります。", "product": "IETF Service Location Protocol (SLP)", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、信頼できないネットワーク（インターネットに直接接続されている環境を含む）上のすべてのシステムで SLP サービスまたはポート 427/UDP を無効化してください。", "「CVE-2023-29552」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks", "label": "CISAが示す関連情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-29552", "label": "CVE公式レコード" }, { "url": "https://datatracker.ietf.org/doc/html/rfc2608", "label": "CVE掲載の参考情報" }, { "url": "https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp", "label": "CISAが示す関連情報" }, { "url": "https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.suse.com/support/kb/doc/?id=000021051", "label": "CVE掲載の参考情報" }, { "url": "https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/curesec/slpload", "label": "CVE掲載の参考情報" }, { "url": "https://security.netapp.com/advisory/ntap-20230426-0001/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29552", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-04-25T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:48.255Z", "fetchedAt": "2026-10-24T05:25:53.054Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-29552", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "fetchedAt": "2026-10-24T05:25:53.054Z", "publishedAt": "2023-04-25T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:48.255Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://datatracker.ietf.org/doc/html/rfc2608", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://www.suse.com/support/kb/doc/?id=000021051", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://github.com/curesec/slpload", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://security.netapp.com/advisory/ntap-20230426-0001/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"text\",\"lang\":\"en\",\"description\":\"n/a\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"NONE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-29552:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "sourcePath": "retained:/originalText", "text": "The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-29552:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "modifiedAt": "2023-11-08T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:48.255Z", "fetchedAt": "2026-10-24T05:25:53.054Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-08T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.", "sourceSummary": "n/aにサービス停止に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "処理の停止や過大な負荷により、サービスを利用できなくなる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:25:53.054Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ea89efcf7eeb1927031913a12424fec13e8d1d679a0afe76f122e4e7026a5a3a", "sourceModifiedAt": "2025-10-21T23:05:48.255Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Service Location Protocol (SLP) は、認証されていないリモート攻撃者が任意のサービスを登録できるため、偽装した UDP トラフィックを利用して大きな増幅効果を伴うサービス拒否 (DoS) 攻撃を実行できる可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、対象システムに対してサービス拒否 (DoS) 攻撃が行われ、正常なサービスが利用できなくなる恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "攻撃者は認証されていないリモートの存在であることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者は SLP に任意のサービスを登録できる権限を持つ必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者は偽装した UDP パケットを送信できる環境であることが必要です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json" ], "evidenceIds": [ "E3" ] }, { "text": "「IETF Service Location Protocol (SLP)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-29552", "https://datatracker.ietf.org/doc/html/rfc2608", "https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp", "https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html", "https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks", "https://www.suse.com/support/kb/doc/?id=000021051", "https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html", "https://github.com/curesec/slpload", "https://security.netapp.com/advisory/ntap-20230426-0001/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "https://nvd.nist.gov/vuln/detail/CVE-2023-29552" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、信頼できないネットワーク（インターネットに直接接続されている環境を含む）上のすべてのシステムで SLP サービスまたはポート 427/UDP を無効化してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2023-29552」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-29552", "https://datatracker.ietf.org/doc/html/rfc2608", "https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp", "https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html", "https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks", "https://www.suse.com/support/kb/doc/?id=000021051", "https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html", "https://github.com/curesec/slpload", "https://security.netapp.com/advisory/ntap-20230426-0001/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "https://nvd.nist.gov/vuln/detail/CVE-2023-29552" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-29552", "https://datatracker.ietf.org/doc/html/rfc2608", "https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp", "https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html", "https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks", "https://www.suse.com/support/kb/doc/?id=000021051", "https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html", "https://github.com/curesec/slpload", "https://security.netapp.com/advisory/ntap-20230426-0001/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "https://nvd.nist.gov/vuln/detail/CVE-2023-29552" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-29552", "https://datatracker.ietf.org/doc/html/rfc2608", "https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp", "https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html", "https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks", "https://www.suse.com/support/kb/doc/?id=000021051", "https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html", "https://github.com/curesec/slpload", "https://security.netapp.com/advisory/ntap-20230426-0001/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "https://nvd.nist.gov/vuln/detail/CVE-2023-29552" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-29552", "https://datatracker.ietf.org/doc/html/rfc2608", "https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp", "https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html", "https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks", "https://www.suse.com/support/kb/doc/?id=000021051", "https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html", "https://github.com/curesec/slpload", "https://security.netapp.com/advisory/ntap-20230426-0001/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "https://nvd.nist.gov/vuln/detail/CVE-2023-29552" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks", "label": "CISAが示す関連情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-29552", "label": "CVE公式レコード" }, { "url": "https://datatracker.ietf.org/doc/html/rfc2608", "label": "CVE掲載の参考情報" }, { "url": "https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp", "label": "CISAが示す関連情報" }, { "url": "https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.suse.com/support/kb/doc/?id=000021051", "label": "CVE掲載の参考情報" }, { "url": "https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/curesec/slpload", "label": "CVE掲載の参考情報" }, { "url": "https://security.netapp.com/advisory/ntap-20230426-0001/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29552", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "sourceField": "retained:/originalText", "excerpt": "The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/29xxx/CVE-2023-29552.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-29552\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-29552（IETF Service Location Protocol (SLP)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者は認証されていないリモートの存在であることが前提です。\n・攻撃者は SLP に任意のサービスを登録できる権限を持つ必要があります。\n・攻撃者は偽装した UDP パケットを送信できる環境であることが必要です。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-29552", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:25:53.054Z", "lastSuccess": "2026-10-24T05:25:53.054Z", "sourceCheckedAt": "2026-10-24T05:25:53.054Z", "errorCode": null }, "glossary": [ { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-22518", "aliases": [], "title": "Confluence Data Center / Confluence Server：脆弱性情報", "summary": "公式説明では Confluence Data Center および Server のすべてのバージョンが影響を受けると記載されていますが、対象表（S4・S5）ではバージョン 1.0.0 以降は影響があるものの、7.19.16 以上、8.3.4 以上、8.4.4 以上、8.5.3 以上、8.6.1 以上は影響なしとされています。", "risk": "攻撃者が管理者アカウントを取得すると、機密性・完全性・可用性がすべて失われる可能性があります。", "product": "Confluence Data Center / Confluence Server", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.0", "cvssSource": "atlassian", "cvssVector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Confluence Data Center", "range": ">= 1.0.0" }, { "product": "Confluence Server", "range": ">= 1.0.0" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止してください。", "「CVE-2023-22518」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "label": "CVE：atlassian" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-22518", "label": "CVE公式レコード" }, { "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/CONFSERVER-93142", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22518", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-10-31T14:30:00.418Z", "modifiedAt": "2025-10-21T23:05:32.975Z", "fetchedAt": "2026-10-24T05:25:53.054Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. \n\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Atlassian", "product": "Confluence Data Center", "versions": [ { "version": "< 1.0.0", "status": "unaffected" }, { "version": ">= 1.0.0", "status": "affected" }, { "version": ">= 7.19.16", "status": "unaffected" }, { "version": ">= 8.3.4", "status": "unaffected" }, { "version": ">= 8.4.4", "status": "unaffected" }, { "version": ">= 8.5.3", "status": "unaffected" }, { "version": ">= 8.6.1", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Confluence Server", "versions": [ { "version": "< 1.0.0", "status": "unaffected" }, { "version": ">= 1.0.0", "status": "affected" }, { "version": ">= 7.19.16", "status": "unaffected" }, { "version": ">= 8.3.4", "status": "unaffected" }, { "version": ">= 8.4.4", "status": "unaffected" }, { "version": ">= 8.5.3", "status": "unaffected" }, { "version": ">= 8.6.1", "status": "unaffected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-22518", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "fetchedAt": "2026-10-24T05:25:53.054Z", "publishedAt": "2023-10-31T14:30:00.418Z", "modifiedAt": "2025-10-21T23:05:32.975Z", "state": "published", "provider": "atlassian", "title": "", "descriptions": [ { "lang": "en", "value": "All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. \n\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Atlassian", "product": "Confluence Data Center", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "< 1.0.0", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": ">= 1.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": ">= 7.19.16", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": ">= 8.3.4", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": ">= 8.4.4", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": ">= 8.5.3", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": ">= 8.6.1", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Confluence Server", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "< 1.0.0", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": ">= 1.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": ">= 7.19.16", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": ">= 8.3.4", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": ">= 8.4.4", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": ">= 8.5.3", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": ">= 8.6.1", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Improper Authorization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "atlassian", "sourcePath": "/containers/cna/metrics/0/cvssV3_0" } ], "references": [ { "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://jira.atlassian.com/browse/CONFSERVER-93142", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22518", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Atlassian\",\"product\":\"Confluence Data Center\",\"versions\":[{\"version\":\"< 1.0.0\",\"status\":\"unaffected\"},{\"version\":\">= 1.0.0\",\"status\":\"affected\"},{\"version\":\">= 7.19.16\",\"status\":\"unaffected\"},{\"version\":\">= 8.3.4\",\"status\":\"unaffected\"},{\"version\":\">= 8.4.4\",\"status\":\"unaffected\"},{\"version\":\">= 8.5.3\",\"status\":\"unaffected\"},{\"version\":\">= 8.6.1\",\"status\":\"unaffected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Atlassian\",\"product\":\"Confluence Server\",\"versions\":[{\"version\":\"< 1.0.0\",\"status\":\"unaffected\"},{\"version\":\">= 1.0.0\",\"status\":\"affected\"},{\"version\":\">= 7.19.16\",\"status\":\"unaffected\"},{\"version\":\">= 8.3.4\",\"status\":\"unaffected\"},{\"version\":\">= 8.4.4\",\"status\":\"unaffected\"},{\"version\":\">= 8.5.3\",\"status\":\"unaffected\"},{\"version\":\">= 8.6.1\",\"status\":\"unaffected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. \n\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Improper Authorization\",\"lang\":\"en\",\"type\":\"Improper Authorization\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-22518:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "sourcePath": "retained:/originalText", "text": "Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-22518:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "modifiedAt": "2023-11-07T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:32.975Z", "fetchedAt": "2026-10-24T05:25:53.054Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-07T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Confluence Data Center / Confluence Serverに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:25:53.054Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "596a99183388983f0b57448c5fc1c6a278a5df79a0c0fd26c2d064767b361f4a", "sourceModifiedAt": "2025-10-21T23:05:32.975Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "公式説明では Confluence Data Center および Server のすべてのバージョンが影響を受けると記載されていますが、対象表（S4・S5）ではバージョン 1.0.0 以降は影響があるものの、7.19.16 以上、8.3.4 以上、8.4.4 以上、8.5.3 以上、8.6.1 以上は影響なしとされています。", "risk": "攻撃者が管理者アカウントを取得すると、機密性・完全性・可用性がすべて失われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2", "E3" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されていない攻撃者が Confluence Data Center または Server に対してリセットを実行し、管理者アカウントを作成できる場合に成立します。作成された管理者アカウントで利用可能なすべての管理操作が実行可能となります。atlassian.net ドメインで提供される Atlassian Cloud のサイトは対象外です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Atlassian / Confluence Data Center。影響なしとして記載：< 1.0.0。影響ありとして記載：>= 1.0.0。影響なしとして記載：>= 7.19.16。影響なしとして記載：>= 8.3.4。影響なしとして記載：>= 8.4.4。影響なしとして記載：>= 8.5.3。影響なしとして記載：>= 8.6.1。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Atlassian / Confluence Server。影響なしとして記載：< 1.0.0。影響ありとして記載：>= 1.0.0。影響なしとして記載：>= 7.19.16。影響なしとして記載：>= 8.3.4。影響なしとして記載：>= 8.4.4。影響なしとして記載：>= 8.5.3。影響なしとして記載：>= 8.6.1。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Confluence Data Center / Confluence Server」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-22518", "https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907", "https://jira.atlassian.com/browse/CONFSERVER-93142", "http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-22518" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が入手できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2023-22518」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-22518", "https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907", "https://jira.atlassian.com/browse/CONFSERVER-93142", "http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-22518" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-22518", "https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907", "https://jira.atlassian.com/browse/CONFSERVER-93142", "http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-22518" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-22518", "https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907", "https://jira.atlassian.com/browse/CONFSERVER-93142", "http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-22518" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-22518", "https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907", "https://jira.atlassian.com/browse/CONFSERVER-93142", "http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-22518" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "label": "CVE：atlassian" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-22518", "label": "CVE公式レコード" }, { "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/CONFSERVER-93142", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22518", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. \n\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Atlassian\",\"product\":\"Confluence Data Center\",\"versions\":[{\"version\":\"< 1.0.0\",\"status\":\"unaffected\"},{\"version\":\">= 1.0.0\",\"status\":\"affected\"},{\"version\":\">= 7.19.16\",\"status\":\"unaffected\"},{\"version\":\">= 8.3.4\",\"status\":\"unaffected\"},{\"version\":\">= 8.4.4\",\"status\":\"unaffected\"},{\"version\":\">= 8.5.3\",\"status\":\"unaffected\"},{\"version\":\">= 8.6.1\",\"status\":\"unaffected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/22xxx/CVE-2023-22518.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Atlassian\",\"product\":\"Confluence Server\",\"versions\":[{\"version\":\"< 1.0.0\",\"status\":\"unaffected\"},{\"version\":\">= 1.0.0\",\"status\":\"affected\"},{\"version\":\">= 7.19.16\",\"status\":\"unaffected\"},{\"version\":\">= 8.3.4\",\"status\":\"unaffected\"},{\"version\":\">= 8.4.4\",\"status\":\"unaffected\"},{\"version\":\">= 8.5.3\",\"status\":\"unaffected\"},{\"version\":\">= 8.6.1\",\"status\":\"unaffected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "sourceField": "/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-22518\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-22518（Confluence Data Center / Confluence Server）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者が Confluence Data Center または Server に対してリセットを実行し、管理者アカウントを作成できる場合に成立します。作成された管理者アカウントで利用可能なすべての管理操作が実行可能となります。atlassian.net ドメインで提供される Atlassian Cloud のサイトは対象外です。\n・公式の対象表：Atlassian / Confluence Data Center。影響なしとして記載：< 1.0.0。影響ありとして記載：>= 1.0.0。影響なしとして記載：>= 7.19.16。影響なしとして記載：>= 8.3.4。影響なしとして記載：>= 8.4.4。影響なしとして記載：>= 8.5.3。影響なしとして記載：>= 8.6.1。\n・公式の対象表：Atlassian / Confluence Server。影響なしとして記載：< 1.0.0。影響ありとして記載：>= 1.0.0。影響なしとして記載：>= 7.19.16。影響なしとして記載：>= 8.3.4。影響なしとして記載：>= 8.4.4。影響なしとして記載：>= 8.5.3。影響なしとして記載：>= 8.6.1。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-22518", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:25:53.054Z", "lastSuccess": "2026-10-24T05:25:53.054Z", "sourceCheckedAt": "2026-10-24T05:25:53.054Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-46604", "aliases": [], "title": "Apache ActiveMQ / Apache ActiveMQ Legacy OpenWire Module：コード実行", "summary": "Java の OpenWire プロトコルのマーシャラーに未検証のデシリアライズの問題があり、ネットワーク上から OpenWire ブローカーまたはクライアントに対してシリアライズされたクラス型を操作すると、クラスパス上の任意のクラスがインスタンス化され、任意のシェルコマンドが実行される可能性があります。", "risk": "リモートの攻撃者がネットワーク経由でブローカーやクライアント上で任意のシェルコマンドを実行できるようになる可能性があります。", "product": "Apache ActiveMQ / Apache ActiveMQ Legacy OpenWire Module", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "apache", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H", "affected": [ { "product": "Apache ActiveMQ", "range": ">= 5.18.0 / < 5.18.3" }, { "product": "Apache ActiveMQ", "range": ">= 5.17.0 / < 5.17.6" }, { "product": "Apache ActiveMQ", "range": ">= 5.16.0 / < 5.16.7" }, { "product": "Apache ActiveMQ", "range": "< 5.15.16" }, { "product": "Apache ActiveMQ Legacy OpenWire Module", "range": ">= 5.18.0 / < 5.18.3" }, { "product": "Apache ActiveMQ Legacy OpenWire Module", "range": ">= 5.17.0 / < 5.17.6" }, { "product": "Apache ActiveMQ Legacy OpenWire Module", "range": ">= 5.16.0 / < 5.16.7" }, { "product": "Apache ActiveMQ Legacy OpenWire Module", "range": ">= 5.8.0 / < 5.15.16" } ], "fixed": [], "steps": [ "ブローカーとクライアントの両方をバージョン 5.15.16、5.16.7、5.17.6、5.18.3 にアップグレードすることで本問題を修正できます。", "「CVE-2023-46604」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "label": "CVE：apache" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-46604", "label": "CVE公式レコード" }, { "url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt", "label": "CISAが示す関連情報" }, { "url": "https://www.openwall.com/lists/oss-security/2023/10/27/5", "label": "CVE掲載の参考情報" }, { "url": "https://security.netapp.com/advisory/ntap-20231110-0010/", "label": "CVE掲載の参考情報" }, { "url": "https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html", "label": "CVE掲載の参考情報" }, { "url": "http://seclists.org/fulldisclosure/2024/Apr/18", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46604", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-10-27T14:59:31.046Z", "modifiedAt": "2025-11-03T21:50:00.516Z", "fetchedAt": "2026-10-24T06:23:26.490Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.", "sourceTitle": "Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.activemq:activemq-client", "product": "Apache ActiveMQ", "vendor": "Apache Software Foundation", "versions": [ { "lessThan": "5.18.3", "status": "affected", "version": "5.18.0", "versionType": "semver" }, { "lessThan": "5.17.6", "status": "affected", "version": "5.17.0", "versionType": "semver" }, { "lessThan": "5.16.7", "status": "affected", "version": "5.16.0", "versionType": "semver" }, { "lessThan": "5.15.16", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.activemq:activemq-openwire-legacy", "product": "Apache ActiveMQ Legacy OpenWire Module", "vendor": "Apache Software Foundation", "versions": [ { "lessThan": "5.18.3", "status": "affected", "version": "5.18.0", "versionType": "semver" }, { "lessThan": "5.17.6", "status": "affected", "version": "5.17.0", "versionType": "semver" }, { "lessThan": "5.16.7", "status": "affected", "version": "5.16.0", "versionType": "semver" }, { "lessThan": "5.15.16", "status": "affected", "version": "5.8.0", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-46604", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "fetchedAt": "2026-10-24T06:23:26.490Z", "publishedAt": "2023-10-27T14:59:31.046Z", "modifiedAt": "2025-11-03T21:50:00.516Z", "state": "published", "provider": "apache", "title": "Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack", "descriptions": [ { "lang": "en", "value": "The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache ActiveMQ", "sourcePath": "/containers/cna/affected/0", "packageName": "org.apache.activemq:activemq-client", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "5.18.0", "lessThan": "5.18.3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "5.17.0", "lessThan": "5.17.6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "5.16.0", "lessThan": "5.16.7", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "0", "lessThan": "5.15.16", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Apache Software Foundation", "product": "Apache ActiveMQ Legacy OpenWire Module", "sourcePath": "/containers/cna/affected/1", "packageName": "org.apache.activemq:activemq-openwire-legacy", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "5.18.0", "lessThan": "5.18.3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "5.17.0", "lessThan": "5.17.6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "5.16.0", "lessThan": "5.16.7", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "5.8.0", "lessThan": "5.15.16", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "apache", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt", "label": "CVE", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.openwall.com/lists/oss-security/2023/10/27/5", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://security.netapp.com/advisory/ntap-20231110-0010/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://seclists.org/fulldisclosure/2024/Apr/18", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"defaultStatus\":\"unaffected\",\"packageName\":\"org.apache.activemq:activemq-client\",\"product\":\"Apache ActiveMQ\",\"vendor\":\"Apache Software Foundation\",\"versions\":[{\"lessThan\":\"5.18.3\",\"status\":\"affected\",\"version\":\"5.18.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.17.6\",\"status\":\"affected\",\"version\":\"5.17.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.16.7\",\"status\":\"affected\",\"version\":\"5.16.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.15.16\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"defaultStatus\":\"unaffected\",\"packageName\":\"org.apache.activemq:activemq-openwire-legacy\",\"product\":\"Apache ActiveMQ Legacy OpenWire Module\",\"vendor\":\"Apache Software Foundation\",\"versions\":[{\"lessThan\":\"5.18.3\",\"status\":\"affected\",\"version\":\"5.18.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.17.6\",\"status\":\"affected\",\"version\":\"5.17.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.16.7\",\"status\":\"affected\",\"version\":\"5.16.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.15.16\",\"status\":\"affected\",\"version\":\"5.8.0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-502\",\"description\":\"CWE-502 Deserialization of Untrusted Data\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-46604:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "sourcePath": "retained:/originalText", "text": "Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-46604:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "modifiedAt": "2023-11-02T00:00:00.000Z", "fetchedAt": "2026-10-24T06:17:49.270Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-11-03T21:50:00.516Z", "fetchedAt": "2026-10-24T06:23:26.490Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-11-02T00:00:00.000Z", "fetchedAt": "2026-10-24T06:17:49.270Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Apache ActiveMQ / Apache ActiveMQ Legacy OpenWire Moduleにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T06:23:26.490Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "da9f84d4732ad2ad7d1d24ef9949c34039f9911dacccd4efc67d90ad9f62dab1", "sourceModifiedAt": "2025-11-03T21:50:00.516Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Java の OpenWire プロトコルのマーシャラーに未検証のデシリアライズの問題があり、ネットワーク上から OpenWire ブローカーまたはクライアントに対してシリアライズされたクラス型を操作すると、クラスパス上の任意のクラスがインスタンス化され、任意のシェルコマンドが実行される可能性があります。", "risk": "リモートの攻撃者がネットワーク経由でブローカーやクライアント上で任意のシェルコマンドを実行できるようになる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "攻撃者がネットワークアクセスを持ち、Java ベースの OpenWire ブローカーまたはクライアントに対してシリアライズされたクラス型を送信できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "対象は Apache ActiveMQ および Apache ActiveMQ Legacy OpenWire Module の Java 実装です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Apache Software Foundation / Apache ActiveMQ。影響ありとして記載：5.18.0以上、5.18.3未満。影響ありとして記載：5.17.0以上、5.17.6未満。影響ありとして記載：5.16.0以上、5.16.7未満。影響ありとして記載：5.15.16未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apache Software Foundation / Apache ActiveMQ Legacy OpenWire Module。影響ありとして記載：5.18.0以上、5.18.3未満。影響ありとして記載：5.17.0以上、5.17.6未満。影響ありとして記載：5.16.0以上、5.16.7未満。影響ありとして記載：5.8.0以上、5.15.16未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604" ], "evidenceIds": [ "E7" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json" ], "evidenceIds": [ "E4" ] }, { "text": "「Apache ActiveMQ / Apache ActiveMQ Legacy OpenWire Module」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-46604", "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt", "https://www.openwall.com/lists/oss-security/2023/10/27/5", "https://security.netapp.com/advisory/ntap-20231110-0010/", "https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html", "https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html", "http://seclists.org/fulldisclosure/2024/Apr/18", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "https://nvd.nist.gov/vuln/detail/CVE-2023-46604" ] } ], "actions": [ { "text": "ブローカーとクライアントの両方をバージョン 5.15.16、5.16.7、5.17.6、5.18.3 にアップグレードすることで本問題を修正できます。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2023-46604」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-46604", "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt", "https://www.openwall.com/lists/oss-security/2023/10/27/5", "https://security.netapp.com/advisory/ntap-20231110-0010/", "https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html", "https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html", "http://seclists.org/fulldisclosure/2024/Apr/18", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "https://nvd.nist.gov/vuln/detail/CVE-2023-46604" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-46604", "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt", "https://www.openwall.com/lists/oss-security/2023/10/27/5", "https://security.netapp.com/advisory/ntap-20231110-0010/", "https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html", "https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html", "http://seclists.org/fulldisclosure/2024/Apr/18", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "https://nvd.nist.gov/vuln/detail/CVE-2023-46604" ] } ], "temporaryMitigations": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604" ], "evidenceIds": [ "E6" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-46604", "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt", "https://www.openwall.com/lists/oss-security/2023/10/27/5", "https://security.netapp.com/advisory/ntap-20231110-0010/", "https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html", "https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html", "http://seclists.org/fulldisclosure/2024/Apr/18", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "https://nvd.nist.gov/vuln/detail/CVE-2023-46604" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "label": "CVE：apache" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-46604", "label": "CVE公式レコード" }, { "url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt", "label": "CISAが示す関連情報" }, { "url": "https://www.openwall.com/lists/oss-security/2023/10/27/5", "label": "CVE掲載の参考情報" }, { "url": "https://security.netapp.com/advisory/ntap-20231110-0010/", "label": "CVE掲載の参考情報" }, { "url": "https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html", "label": "CVE掲載の参考情報" }, { "url": "http://seclists.org/fulldisclosure/2024/Apr/18", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46604", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "sourceField": "/containers/cna/title", "excerpt": "Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "sourceField": "retained:/originalText", "excerpt": "Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"defaultStatus\":\"unaffected\",\"packageName\":\"org.apache.activemq:activemq-client\",\"product\":\"Apache ActiveMQ\",\"vendor\":\"Apache Software Foundation\",\"versions\":[{\"lessThan\":\"5.18.3\",\"status\":\"affected\",\"version\":\"5.18.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.17.6\",\"status\":\"affected\",\"version\":\"5.17.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.16.7\",\"status\":\"affected\",\"version\":\"5.16.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.15.16\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46604.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"defaultStatus\":\"unaffected\",\"packageName\":\"org.apache.activemq:activemq-openwire-legacy\",\"product\":\"Apache ActiveMQ Legacy OpenWire Module\",\"vendor\":\"Apache Software Foundation\",\"versions\":[{\"lessThan\":\"5.18.3\",\"status\":\"affected\",\"version\":\"5.18.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.17.6\",\"status\":\"affected\",\"version\":\"5.17.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.16.7\",\"status\":\"affected\",\"version\":\"5.16.0\",\"versionType\":\"semver\"},{\"lessThan\":\"5.15.16\",\"status\":\"affected\",\"version\":\"5.8.0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46604", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-46604\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-46604（Apache ActiveMQ / Apache ActiveMQ Legacy OpenWire Module）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者がネットワークアクセスを持ち、Java ベースの OpenWire ブローカーまたはクライアントに対してシリアライズされたクラス型を送信できること。\n・対象は Apache ActiveMQ および Apache ActiveMQ Legacy OpenWire Module の Java 実装です。\n・公式の対象表：Apache Software Foundation / Apache ActiveMQ。影響ありとして記載：5.18.0以上、5.18.3未満。影響ありとして記載：5.17.0以上、5.17.6未満。影響ありとして記載：5.16.0以上、5.16.7未満。影響ありとして記載：5.15.16未満の版。\n・公式の対象表：Apache Software Foundation / Apache ActiveMQ Legacy OpenWire Module。影響ありとして記載：5.18.0以上、5.18.3未満。影響ありとして記載：5.17.0以上、5.17.6未満。影響ありとして記載：5.16.0以上、5.16.7未満。影響ありとして記載：5.8.0以上、5.15.16未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-46604", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T06:23:26.490Z", "lastSuccess": "2026-10-24T06:23:26.490Z", "sourceCheckedAt": "2026-10-24T06:23:26.490Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-46747", "aliases": [], "title": "BIG-IP：コード実行", "summary": "認証されていないリクエストが構成ユーティリティの認証を回避できるため、管理ポートや自己 IP アドレス経由でネットワークに接続できる攻撃者が BIG‑IP システム上で任意のシステムコマンドを実行できる可能性があります。", "risk": "攻撃者が任意のシステムコマンドを実行できるため、サーバー上で不正な処理が行われる危険があります。", "product": "BIG-IP", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "f5", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "BIG-IP", "range": ">= 17.1.0 / < * / 範囲内で状態が変わります（開始時: 影響あり。変更点: Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.isoから影響なし, Hotfix-BIGIP-17.1.1.0.2.6-ENG.isoから影響なし。版の順序・条件は原文確認）（機能: All Modules）" }, { "product": "BIG-IP", "range": ">= 16.1.0 / < * / 範囲内で状態が変わります（開始時: 影響あり。変更点: Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.isoから影響なし。版の順序・条件は原文確認）（機能: All Modules）" }, { "product": "BIG-IP", "range": ">= 15.1.0 / < * / 範囲内で状態が変わります（開始時: 影響あり。変更点: Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.isoから影響なし。版の順序・条件は原文確認）（機能: All Modules）" }, { "product": "BIG-IP", "range": ">= 14.1.0 / < * / 範囲内で状態が変わります（開始時: 影響あり。変更点: Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.isoから影響なし。版の順序・条件は原文確認）（機能: All Modules）" }, { "product": "BIG-IP", "range": ">= 13.1.0 / < * / 範囲内で状態が変わります（開始時: 影響あり。変更点: Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.isoから影響なし。版の順序・条件は原文確認）（機能: All Modules）" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2023-46747」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json", "label": "CVE：f5" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-46747", "label": "CVE公式レコード" }, { "url": "https://my.f5.com/manage/s/article/K000137353", "label": "CISAが示す関連情報" }, { "url": "http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46747", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-10-26T20:04:53.929Z", "modifiedAt": "2025-10-21T23:05:33.431Z", "fetchedAt": "2026-10-24T05:26:11.092Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "sourceTitle": "BIG-IP Configuration utility unauthenticated remote code execution vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unknown", "modules": [ "All Modules" ], "product": "BIG-IP", "vendor": "F5", "versions": [ { "changes": [ { "at": "Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.iso", "status": "unaffected" }, { "at": "Hotfix-BIGIP-17.1.1.0.2.6-ENG.iso", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "17.1.0", "versionType": "semver" }, { "changes": [ { "at": "Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.iso", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "16.1.0", "versionType": "semver" }, { "changes": [ { "at": "Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.iso", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "15.1.0", "versionType": "semver" }, { "changes": [ { "at": "Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.iso", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "14.1.0", "versionType": "semver" }, { "changes": [ { "at": "Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.iso", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "13.1.0", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: All Modules。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-46747", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json", "fetchedAt": "2026-10-24T05:26:11.092Z", "publishedAt": "2023-10-26T20:04:53.929Z", "modifiedAt": "2025-10-21T23:05:33.431Z", "state": "published", "provider": "f5", "title": "BIG-IP Configuration utility unauthenticated remote code execution vulnerability", "descriptions": [ { "lang": "en", "value": "Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "F5", "product": "BIG-IP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [ "All Modules" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "17.1.0", "lessThan": "*", "versionType": "semver", "status": "affected", "changes": [ { "at": "Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.iso", "status": "unaffected" }, { "at": "Hotfix-BIGIP-17.1.1.0.2.6-ENG.iso", "status": "unaffected" } ] }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "16.1.0", "lessThan": "*", "versionType": "semver", "status": "affected", "changes": [ { "at": "Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.iso", "status": "unaffected" } ] }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "15.1.0", "lessThan": "*", "versionType": "semver", "status": "affected", "changes": [ { "at": "Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.iso", "status": "unaffected" } ] }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "14.1.0", "lessThan": "*", "versionType": "semver", "status": "affected", "changes": [ { "at": "Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.iso", "status": "unaffected" } ] }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "13.1.0", "lessThan": "*", "versionType": "semver", "status": "affected", "changes": [ { "at": "Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.iso", "status": "unaffected" } ] } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-288", "lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "f5", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://my.f5.com/manage/s/article/K000137353", "label": "CVE", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unknown\",\"modules\":[\"All Modules\"],\"product\":\"BIG-IP\",\"vendor\":\"F5\",\"versions\":[{\"changes\":[{\"at\":\"Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.iso\",\"status\":\"unaffected\"},{\"at\":\"Hotfix-BIGIP-17.1.1.0.2.6-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"17.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"16.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"15.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"14.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"13.1.0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-288\",\"description\":\"CWE-288 Authentication Bypass Using an Alternate Path or Channel\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-46747:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "sourcePath": "retained:/originalText", "text": "F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-46747:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "modifiedAt": "2023-10-31T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:33.431Z", "fetchedAt": "2026-10-24T05:26:11.092Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-10-31T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "BIG-IPにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:26:11.092Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c86f39b4f17db8f8f78f1134e7de0ff663da558b2fff9be0855a3f437da0f725", "sourceModifiedAt": "2025-10-21T23:05:33.431Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "認証されていないリクエストが構成ユーティリティの認証を回避できるため、管理ポートや自己 IP アドレス経由でネットワークに接続できる攻撃者が BIG‑IP システム上で任意のシステムコマンドを実行できる可能性があります。", "risk": "攻撃者が任意のシステムコマンドを実行できるため、サーバー上で不正な処理が行われる危険があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "ネットワークから管理ポートまたは自己 IP アドレスにアクセスできる状態で、認証されていない攻撃者が対象となります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：F5 / BIG-IP。影響ありとして記載：17.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.isoから影響なし、Hotfix-BIGIP-17.1.1.0.2.6-ENG.isoから影響なし。影響ありとして記載：16.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.isoから影響なし。影響ありとして記載：15.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.isoから影響なし。影響ありとして記載：14.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.isoから影響なし。影響ありとして記載：13.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.isoから影響なし。対象の機能：All Modules。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json" ], "evidenceIds": [ "E3" ] }, { "text": "「BIG-IP」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-46747", "https://my.f5.com/manage/s/article/K000137353", "http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html", "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "https://nvd.nist.gov/vuln/detail/CVE-2023-46747" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2023-46747」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-46747", "https://my.f5.com/manage/s/article/K000137353", "http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html", "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "https://nvd.nist.gov/vuln/detail/CVE-2023-46747" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-46747", "https://my.f5.com/manage/s/article/K000137353", "http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html", "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "https://nvd.nist.gov/vuln/detail/CVE-2023-46747" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-46747", "https://my.f5.com/manage/s/article/K000137353", "http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html", "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "https://nvd.nist.gov/vuln/detail/CVE-2023-46747" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-46747", "https://my.f5.com/manage/s/article/K000137353", "http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html", "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "https://nvd.nist.gov/vuln/detail/CVE-2023-46747" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json", "label": "CVE：f5" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-46747", "label": "CVE公式レコード" }, { "url": "https://my.f5.com/manage/s/article/K000137353", "label": "CISAが示す関連情報" }, { "url": "http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46747", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json", "sourceField": "/containers/cna/title", "excerpt": "BIG-IP Configuration utility unauthenticated remote code execution vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46747.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unknown\",\"modules\":[\"All Modules\"],\"product\":\"BIG-IP\",\"vendor\":\"F5\",\"versions\":[{\"changes\":[{\"at\":\"Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.iso\",\"status\":\"unaffected\"},{\"at\":\"Hotfix-BIGIP-17.1.1.0.2.6-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"17.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"16.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"15.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"14.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"13.1.0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-46747\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-46747（BIG-IP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ネットワークから管理ポートまたは自己 IP アドレスにアクセスできる状態で、認証されていない攻撃者が対象となります。\n・公式の対象表：F5 / BIG-IP。影響ありとして記載：17.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.isoから影響なし、Hotfix-BIGIP-17.1.1.0.2.6-ENG.isoから影響なし。影響ありとして記載：16.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.isoから影響なし。影響ありとして記載：15.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.isoから影響なし。影響ありとして記載：14.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.isoから影響なし。影響ありとして記載：13.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.isoから影響なし。対象の機能：All Modules。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-46747", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:26:11.092Z", "lastSuccess": "2026-10-24T05:26:11.092Z", "sourceCheckedAt": "2026-10-24T05:26:11.092Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-46748", "aliases": [], "title": "BIG-IP：データベースへの不正操作", "summary": "BIG-IP Configuration utility に認証された SQL インジェクション脆弱性があり、管理ポートやセルフ IP アドレス経由で Configuration utility にネットワークアクセスできる認証済み攻撃者が任意のシステムコマンドを実行できる可能性があります。", "risk": "任意のシステムコマンドを実行できる可能性がある。", "product": "BIG-IP", "category": "other", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "f5", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "BIG-IP", "range": ">= 17.1.0 / < * / 範囲内で状態が変わります（開始時: 影響あり。変更点: Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.isoから影響なし, Hotfix-BIGIP-17.1.1.0.2.6-ENG.isoから影響なし。版の順序・条件は原文確認）（機能: All Modules）" }, { "product": "BIG-IP", "range": ">= 16.1.0 / < * / 範囲内で状態が変わります（開始時: 影響あり。変更点: Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.isoから影響なし。版の順序・条件は原文確認）（機能: All Modules）" }, { "product": "BIG-IP", "range": ">= 15.1.0 / < * / 範囲内で状態が変わります（開始時: 影響あり。変更点: Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.isoから影響なし。版の順序・条件は原文確認）（機能: All Modules）" }, { "product": "BIG-IP", "range": ">= 14.1.0 / < * / 範囲内で状態が変わります（開始時: 影響あり。変更点: Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.isoから影響なし。版の順序・条件は原文確認）（機能: All Modules）" }, { "product": "BIG-IP", "range": ">= 13.1.0 / < * / 範囲内で状態が変わります（開始時: 影響あり。変更点: Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.isoから影響なし。版の順序・条件は原文確認）（機能: All Modules）" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "「CVE-2023-46748」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "label": "CVE：f5" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-46748", "label": "CVE公式レコード" }, { "url": "https://my.f5.com/manage/s/article/K000137365", "label": "CISAが示す関連情報" }, { "url": "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46748", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-10-26T20:05:04.967Z", "modifiedAt": "2025-10-21T23:05:33.293Z", "fetchedAt": "2026-10-24T05:26:21.041Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which \n\nmay allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "sourceTitle": "BIG-IP Configuration utility authenticated SQL injection vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unknown", "modules": [ "All Modules" ], "product": "BIG-IP", "vendor": "F5", "versions": [ { "changes": [ { "at": "Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.iso", "status": "unaffected" }, { "at": "Hotfix-BIGIP-17.1.1.0.2.6-ENG.iso", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "17.1.0", "versionType": "semver" }, { "changes": [ { "at": "Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.iso", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "16.1.0", "versionType": "semver" }, { "changes": [ { "at": "Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.iso", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "15.1.0", "versionType": "semver" }, { "changes": [ { "at": "Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.iso", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "14.1.0", "versionType": "semver" }, { "changes": [ { "at": "Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.iso", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "13.1.0", "versionType": "semver" } ] } ], "configurationNotes": "対象環境・機能: All Modules。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-46748", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "fetchedAt": "2026-10-24T05:26:21.041Z", "publishedAt": "2023-10-26T20:05:04.967Z", "modifiedAt": "2025-10-21T23:05:33.293Z", "state": "published", "provider": "f5", "title": "BIG-IP Configuration utility authenticated SQL injection vulnerability", "descriptions": [ { "lang": "en", "value": "An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which \n\nmay allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "F5", "product": "BIG-IP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [ "All Modules" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "17.1.0", "lessThan": "*", "versionType": "semver", "status": "affected", "changes": [ { "at": "Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.iso", "status": "unaffected" }, { "at": "Hotfix-BIGIP-17.1.1.0.2.6-ENG.iso", "status": "unaffected" } ] }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "16.1.0", "lessThan": "*", "versionType": "semver", "status": "affected", "changes": [ { "at": "Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.iso", "status": "unaffected" } ] }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "15.1.0", "lessThan": "*", "versionType": "semver", "status": "affected", "changes": [ { "at": "Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.iso", "status": "unaffected" } ] }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "14.1.0", "lessThan": "*", "versionType": "semver", "status": "affected", "changes": [ { "at": "Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.iso", "status": "unaffected" } ] }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "13.1.0", "lessThan": "*", "versionType": "semver", "status": "affected", "changes": [ { "at": "Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.iso", "status": "unaffected" } ] } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "f5", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://my.f5.com/manage/s/article/K000137365", "label": "CVE", "tags": [ "vendor-advisory", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46748", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unknown\",\"modules\":[\"All Modules\"],\"product\":\"BIG-IP\",\"vendor\":\"F5\",\"versions\":[{\"changes\":[{\"at\":\"Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.iso\",\"status\":\"unaffected\"},{\"at\":\"Hotfix-BIGIP-17.1.1.0.2.6-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"17.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"16.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"15.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"14.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"13.1.0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which \n\nmay allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-89\",\"description\":\"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-46748:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "sourcePath": "retained:/originalText", "text": "F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-46748:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "modifiedAt": "2023-10-31T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:33.293Z", "fetchedAt": "2026-10-24T05:26:21.041Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-10-31T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "BIG-IPにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:26:21.041Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "819e8a10ac7c53edfbe426efc7d9f11a9558828d5234d6ebb8fb5b3d30e7965b", "sourceModifiedAt": "2025-10-21T23:05:33.293Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "BIG-IP Configuration utility に認証された SQL インジェクション脆弱性があり、管理ポートやセルフ IP アドレス経由で Configuration utility にネットワークアクセスできる認証済み攻撃者が任意のシステムコマンドを実行できる可能性があります。", "risk": "任意のシステムコマンドを実行できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証済みの攻撃者が BIG-IP の管理ポートまたはセルフ IP アドレスを通じて Configuration utility にネットワークアクセスできることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "公式の対象表：F5 / BIG-IP。影響ありとして記載：17.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.isoから影響なし、Hotfix-BIGIP-17.1.1.0.2.6-ENG.isoから影響なし。影響ありとして記載：16.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.isoから影響なし。影響ありとして記載：15.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.isoから影響なし。影響ありとして記載：14.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.isoから影響なし。影響ありとして記載：13.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.isoから影響なし。対象の機能：All Modules。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json" ], "evidenceIds": [ "E4" ] }, { "text": "「BIG-IP」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-46748", "https://my.f5.com/manage/s/article/K000137365", "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "https://nvd.nist.gov/vuln/detail/CVE-2023-46748" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748" ], "evidenceIds": [ "E5" ] }, { "text": "「CVE-2023-46748」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-46748", "https://my.f5.com/manage/s/article/K000137365", "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "https://nvd.nist.gov/vuln/detail/CVE-2023-46748" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-46748", "https://my.f5.com/manage/s/article/K000137365", "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "https://nvd.nist.gov/vuln/detail/CVE-2023-46748" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-46748", "https://my.f5.com/manage/s/article/K000137365", "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "https://nvd.nist.gov/vuln/detail/CVE-2023-46748" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-46748", "https://my.f5.com/manage/s/article/K000137365", "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "https://nvd.nist.gov/vuln/detail/CVE-2023-46748" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "label": "CVE：f5" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-46748", "label": "CVE公式レコード" }, { "url": "https://my.f5.com/manage/s/article/K000137365", "label": "CISAが示す関連情報" }, { "url": "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46748", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which \n\nmay allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "sourceField": "/containers/cna/title", "excerpt": "BIG-IP Configuration utility authenticated SQL injection vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "sourceField": "retained:/originalText", "excerpt": "F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/46xxx/CVE-2023-46748.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unknown\",\"modules\":[\"All Modules\"],\"product\":\"BIG-IP\",\"vendor\":\"F5\",\"versions\":[{\"changes\":[{\"at\":\"Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.iso\",\"status\":\"unaffected\"},{\"at\":\"Hotfix-BIGIP-17.1.1.0.2.6-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"17.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"16.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"15.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"14.1.0\",\"versionType\":\"semver\"},{\"changes\":[{\"at\":\"Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.iso\",\"status\":\"unaffected\"}],\"lessThan\":\"*\",\"status\":\"affected\",\"version\":\"13.1.0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-46748\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-46748（BIG-IP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証済みの攻撃者が BIG-IP の管理ポートまたはセルフ IP アドレスを通じて Configuration utility にネットワークアクセスできることが前提です。\n・公式の対象表：F5 / BIG-IP。影響ありとして記載：17.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.isoから影響なし、Hotfix-BIGIP-17.1.1.0.2.6-ENG.isoから影響なし。影響ありとして記載：16.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.isoから影響なし。影響ありとして記載：15.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.isoから影響なし。影響ありとして記載：14.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.isoから影響なし。影響ありとして記載：13.1.0以上（原資料の上限表記は「*」）。途中の変更：Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.isoから影響なし。対象の機能：All Modules。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-46748", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:26:21.041Z", "lastSuccess": "2026-10-24T05:26:21.041Z", "sourceCheckedAt": "2026-10-24T05:26:21.041Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-5631", "aliases": [], "title": "Roundcubemail：ブラウザー上での不正な処理", "summary": "Roundcube の HTML メールで細工した SVG を含むメールを保存すると、永続的な XSS が発生し、リモート攻撃者が任意の JavaScript を読み込ませることができる。", "risk": "リモート攻撃者が任意の JavaScript を実行できるため、被害者のブラウザー上で不正な処理が行われる可能性がある。", "product": "Roundcubemail", "category": "other", "component": "package", "severity": "medium", "cvss": 6.1, "cvssVersion": "3.1", "cvssSource": "ESET", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "affected": [ { "product": "Roundcubemail", "range": ">= 1.6.0 / < 1.6.3" }, { "product": "Roundcubemail", "range": ">= 1.5.0 / < 1.5.4" }, { "product": "Roundcubemail", "range": ">= 1.4.0 / < 1.5.14" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止する。", "「CVE-2023-5631」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "label": "CVE：ESET" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-5631", "label": "CVE公式レコード" }, { "url": "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/issues/9168", "label": "CVE掲載の参考情報" }, { "url": "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d", "label": "CVE掲載の参考情報" }, { "url": "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15", "label": "CISAが示す関連情報" }, { "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079", "label": "CVE掲載の参考情報" }, { "url": "https://www.debian.org/security/2023/dsa-5531", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5631", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-10-18T14:51:18.443Z", "modifiedAt": "2025-10-21T23:05:34.074Z", "fetchedAt": "2026-10-24T05:26:23.580Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.", "sourceTitle": "Stored XSS vulnerability in Roundcube", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Roundcubemail", "repo": "https://github.com/roundcube/roundcubemail", "vendor": "Roundcube", "versions": [ { "lessThan": "1.6.3", "status": "affected", "version": "1.6.0", "versionType": "semver" }, { "lessThan": "1.5.4", "status": "affected", "version": "1.5.0", "versionType": "semver" }, { "lessThan": "1.5.14", "status": "affected", "version": "1.4.0", "versionType": "semver" }, { "status": "unaffected", "version": "1.6.4" }, { "status": "unaffected", "version": "1.5.5" }, { "status": "unaffected", "version": "1.5.15" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-5631", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "fetchedAt": "2026-10-24T05:26:23.580Z", "publishedAt": "2023-10-18T14:51:18.443Z", "modifiedAt": "2025-10-21T23:05:34.074Z", "state": "published", "provider": "ESET", "title": "Stored XSS vulnerability in Roundcube", "descriptions": [ { "lang": "en", "value": "Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Roundcube", "product": "Roundcubemail", "sourcePath": "/containers/cna/affected/0", "repo": "https://github.com/roundcube/roundcubemail", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "1.6.0", "lessThan": "1.6.3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "1.5.0", "lessThan": "1.5.4", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "1.4.0", "lessThan": "1.5.14", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "1.6.4", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "1.5.5", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "1.5.15", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "Actively used in the wild.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "provider": "ESET", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://github.com/roundcube/roundcubemail/issues/9168", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "https://www.debian.org/security/2023/dsa-5531", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "http://www.openwall.com/lists/oss-security/2023/11/01/1", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "http://www.openwall.com/lists/oss-security/2023/11/01/3", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/12" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/13" }, { "url": "http://www.openwall.com/lists/oss-security/2023/11/17/2", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/14" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Roundcubemail\",\"repo\":\"https://github.com/roundcube/roundcubemail\",\"vendor\":\"Roundcube\",\"versions\":[{\"lessThan\":\"1.6.3\",\"status\":\"affected\",\"version\":\"1.6.0\",\"versionType\":\"semver\"},{\"lessThan\":\"1.5.4\",\"status\":\"affected\",\"version\":\"1.5.0\",\"versionType\":\"semver\"},{\"lessThan\":\"1.5.14\",\"status\":\"affected\",\"version\":\"1.4.0\",\"versionType\":\"semver\"},{\"status\":\"unaffected\",\"version\":\"1.6.4\"},{\"status\":\"unaffected\",\"version\":\"1.5.5\"},{\"status\":\"unaffected\",\"version\":\"1.5.15\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "Actively used in the wild.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-79\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"REQUIRED\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-5631:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "sourcePath": "retained:/originalText", "text": "Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-5631:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "modifiedAt": "2023-10-26T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:34.074Z", "fetchedAt": "2026-10-24T05:26:23.580Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-10-26T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Roundcubemailにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:26:23.580Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c595f932a53606ea003ce465bd8ddea01c1e847dad853d20f13e0bf1fd843d35", "sourceModifiedAt": "2025-10-21T23:05:34.074Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Roundcube の HTML メールで細工した SVG を含むメールを保存すると、永続的な XSS が発生し、リモート攻撃者が任意の JavaScript を読み込ませることができる。", "risk": "リモート攻撃者が任意の JavaScript を実行できるため、被害者のブラウザー上で不正な処理が行われる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "攻撃は、HTML メールに細工した SVG ドキュメントを埋め込んだメールを送信することで実行できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "記述と構造化情報で影響範囲に不一致がある。記述では 1.4.15 未満、1.5.5 未満、1.6.4 未満 とされ、構造化情報では 1.4.0 以上 1.5.14 未満、1.5.0 以上 1.5.4 未満、1.6.0 以上 1.6.3 未満 とされている。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json" ], "evidenceIds": [ "E1", "E4", "E2" ] }, { "text": "公式の対象表：Roundcube / Roundcubemail。影響ありとして記載：1.6.0以上、1.6.3未満。影響ありとして記載：1.5.0以上、1.5.4未満。影響ありとして記載：1.4.0以上、1.5.14未満。影響なしとして記載：1.6.4。影響なしとして記載：1.5.5。影響なしとして記載：1.5.15。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json" ], "evidenceIds": [ "E4" ] }, { "text": "「Roundcubemail」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-5631", "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613", "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4", "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15", "https://github.com/roundcube/roundcubemail/issues/9168", "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released", "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d", "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079", "https://www.debian.org/security/2023/dsa-5531", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "https://nvd.nist.gov/vuln/detail/CVE-2023-5631" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631" ], "evidenceIds": [ "E5" ] }, { "text": "「CVE-2023-5631」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-5631", "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613", "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4", "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15", "https://github.com/roundcube/roundcubemail/issues/9168", "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released", "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d", "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079", "https://www.debian.org/security/2023/dsa-5531", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "https://nvd.nist.gov/vuln/detail/CVE-2023-5631" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-5631", "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613", "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4", "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15", "https://github.com/roundcube/roundcubemail/issues/9168", "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released", "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d", "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079", "https://www.debian.org/security/2023/dsa-5531", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "https://nvd.nist.gov/vuln/detail/CVE-2023-5631" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-5631", "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613", "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4", "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15", "https://github.com/roundcube/roundcubemail/issues/9168", "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released", "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d", "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079", "https://www.debian.org/security/2023/dsa-5531", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "https://nvd.nist.gov/vuln/detail/CVE-2023-5631" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-5631", "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613", "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4", "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15", "https://github.com/roundcube/roundcubemail/issues/9168", "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released", "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d", "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079", "https://www.debian.org/security/2023/dsa-5531", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "https://nvd.nist.gov/vuln/detail/CVE-2023-5631" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "label": "CVE：ESET" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-5631", "label": "CVE公式レコード" }, { "url": "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/issues/9168", "label": "CVE掲載の参考情報" }, { "url": "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d", "label": "CVE掲載の参考情報" }, { "url": "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15", "label": "CISAが示す関連情報" }, { "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079", "label": "CVE掲載の参考情報" }, { "url": "https://www.debian.org/security/2023/dsa-5531", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5631", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "sourceField": "/containers/cna/title", "excerpt": "Stored XSS vulnerability in Roundcube", "language": null }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "sourceField": "retained:/originalText", "excerpt": "Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.", "language": "en", "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/5xxx/CVE-2023-5631.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Roundcubemail\",\"repo\":\"https://github.com/roundcube/roundcubemail\",\"vendor\":\"Roundcube\",\"versions\":[{\"lessThan\":\"1.6.3\",\"status\":\"affected\",\"version\":\"1.6.0\",\"versionType\":\"semver\"},{\"lessThan\":\"1.5.4\",\"status\":\"affected\",\"version\":\"1.5.0\",\"versionType\":\"semver\"},{\"lessThan\":\"1.5.14\",\"status\":\"affected\",\"version\":\"1.4.0\",\"versionType\":\"semver\"},{\"status\":\"unaffected\",\"version\":\"1.6.4\"},{\"status\":\"unaffected\",\"version\":\"1.5.5\"},{\"status\":\"unaffected\",\"version\":\"1.5.15\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5631", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-5631\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-5631（Roundcubemail）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃は、HTML メールに細工した SVG ドキュメントを埋め込んだメールを送信することで実行できる。\n・記述と構造化情報で影響範囲に不一致がある。記述では 1.4.15 未満、1.5.5 未満、1.6.4 未満 とされ、構造化情報では 1.4.0 以上 1.5.14 未満、1.5.0 以上 1.5.4 未満、1.6.0 以上 1.6.3 未満 とされている。\n・公式の対象表：Roundcube / Roundcubemail。影響ありとして記載：1.6.0以上、1.6.3未満。影響ありとして記載：1.5.0以上、1.5.4未満。影響ありとして記載：1.4.0以上、1.5.14未満。影響なしとして記載：1.6.4。影響なしとして記載：1.5.5。影響なしとして記載：1.5.15。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-5631", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:26:23.580Z", "lastSuccess": "2026-10-24T05:26:23.580Z", "sourceCheckedAt": "2026-10-24T05:26:23.580Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-20273", "aliases": [], "title": "Cisco IOS XE Software：脆弱性情報", "summary": "Cisco IOS XE Software の Web UI 機能において、入力検証が不十分なため、認証されたリモート攻撃者が root 権限でコマンドを注入できる脆弱性があります。攻撃者は Web UI に細工した入力を送信することで、この脆弱性を悪用できます。成功すると、攻撃者は基盤となるオペレーティングシステムに対して root 権限でコマンドを実行できるようになります。", "risk": "攻撃者がこの脆弱性を利用すると、root 権限でコマンドを実行できるため、システム全体を支配されたり、重要な設定やデータを改ざん・削除されたりする可能性があります。", "product": "Cisco IOS XE Software", "category": "other", "component": "package", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Cisco IOS XE Software", "range": "16.1.1" }, { "product": "Cisco IOS XE Software", "range": "16.1.2" }, { "product": "Cisco IOS XE Software", "range": "16.1.3" }, { "product": "Cisco IOS XE Software", "range": "16.2.1" }, { "product": "Cisco IOS XE Software", "range": "16.2.2" }, { "product": "Cisco IOS XE Software", "range": "16.3.1" }, { "product": "Cisco IOS XE Software", "range": "16.3.2" }, { "product": "Cisco IOS XE Software", "range": "16.3.3" }, { "product": "Cisco IOS XE Software", "range": "16.3.1a" }, { "product": "Cisco IOS XE Software", "range": "16.3.4" }, { "product": "Cisco IOS XE Software", "range": "16.3.5" }, { "product": "Cisco IOS XE Software", "range": "16.3.5b" }, { "product": "Cisco IOS XE Software", "range": "16.3.6" }, { "product": "Cisco IOS XE Software", "range": "16.3.7" }, { "product": "Cisco IOS XE Software", "range": "16.3.8" }, { "product": "Cisco IOS XE Software", "range": "16.3.9" }, { "product": "Cisco IOS XE Software", "range": "16.3.10" }, { "product": "Cisco IOS XE Software", "range": "16.3.11" }, { "product": "Cisco IOS XE Software", "range": "16.4.1" }, { "product": "Cisco IOS XE Software", "range": "16.4.2" }, { "product": "Cisco IOS XE Software", "range": "16.4.3" }, { "product": "Cisco IOS XE Software", "range": "16.5.1" }, { "product": "Cisco IOS XE Software", "range": "16.5.1a" }, { "product": "Cisco IOS XE Software", "range": "16.5.1b" }, { "product": "Cisco IOS XE Software", "range": "16.5.2" }, { "product": "Cisco IOS XE Software", "range": "16.5.3" }, { "product": "Cisco IOS XE Software", "range": "16.6.1" }, { "product": "Cisco IOS XE Software", "range": "16.6.2" }, { "product": "Cisco IOS XE Software", "range": "16.6.3" }, { "product": "Cisco IOS XE Software", "range": "16.6.4" }, { "product": "Cisco IOS XE Software", "range": "16.6.5" }, { "product": "Cisco IOS XE Software", "range": "16.6.4a" }, { "product": "Cisco IOS XE Software", "range": "16.6.5a" }, { "product": "Cisco IOS XE Software", "range": "16.6.6" }, { "product": "Cisco IOS XE Software", "range": "16.6.7" }, { "product": "Cisco IOS XE Software", "range": "16.6.8" }, { "product": "Cisco IOS XE Software", "range": "16.6.9" }, { "product": "Cisco IOS XE Software", "range": "16.6.10" }, { "product": "Cisco IOS XE Software", "range": "16.7.1" }, { "product": "Cisco IOS XE Software", "range": "16.7.1a" }, { "product": "Cisco IOS XE Software", "range": "16.7.1b" }, { "product": "Cisco IOS XE Software", "range": "16.7.2" }, { "product": "Cisco IOS XE Software", "range": "16.7.3" }, { "product": "Cisco IOS XE Software", "range": "16.7.4" }, { "product": "Cisco IOS XE Software", "range": "16.8.1" }, { "product": "Cisco IOS XE Software", "range": "16.8.1a" }, { "product": "Cisco IOS XE Software", "range": "16.8.1b" }, { "product": "Cisco IOS XE Software", "range": "16.8.1s" }, { "product": "Cisco IOS XE Software", "range": "16.8.1c" }, { "product": "Cisco IOS XE Software", "range": "16.8.1d" }, { "product": "Cisco IOS XE Software", "range": "16.8.2" }, { "product": "Cisco IOS XE Software", "range": "16.8.1e" }, { "product": "Cisco IOS XE Software", "range": "16.8.3" }, { "product": "Cisco IOS XE Software", "range": "16.9.1" }, { "product": "Cisco IOS XE Software", "range": "16.9.2" }, { "product": "Cisco IOS XE Software", "range": "16.9.1a" }, { "product": "Cisco IOS XE Software", "range": "16.9.1b" }, { "product": "Cisco IOS XE Software", "range": "16.9.1s" }, { "product": "Cisco IOS XE Software", "range": "16.9.3" }, { "product": "Cisco IOS XE Software", "range": "16.9.4" }, { "product": "Cisco IOS XE Software", "range": "16.9.3a" }, { "product": "Cisco IOS XE Software", "range": "16.9.5" }, { "product": "Cisco IOS XE Software", "range": "16.9.5f" }, { "product": "Cisco IOS XE Software", "range": "16.9.6" }, { "product": "Cisco IOS XE Software", "range": "16.9.7" }, { "product": "Cisco IOS XE Software", "range": "16.9.8" }, { "product": "Cisco IOS XE Software", "range": "16.10.1" }, { "product": "Cisco IOS XE Software", "range": "16.10.1a" }, { "product": "Cisco IOS XE Software", "range": "16.10.1b" }, { "product": "Cisco IOS XE Software", "range": "16.10.1s" }, { "product": "Cisco IOS XE Software", "range": "16.10.1c" }, { "product": "Cisco IOS XE Software", "range": "16.10.1e" }, { "product": "Cisco IOS XE Software", "range": "16.10.1d" }, { "product": "Cisco IOS XE Software", "range": "16.10.2" }, { "product": "Cisco IOS XE Software", "range": "16.10.1f" }, { "product": "Cisco IOS XE Software", "range": "16.10.1g" }, { "product": "Cisco IOS XE Software", "range": "16.10.3" }, { "product": "Cisco IOS XE Software", "range": "16.11.1" }, { "product": "Cisco IOS XE Software", "range": "16.11.1a" }, { "product": "Cisco IOS XE Software", "range": "16.11.1b" }, { "product": "Cisco IOS XE Software", "range": "16.11.2" }, { "product": "Cisco IOS XE Software", "range": "16.11.1s" }, { "product": "Cisco IOS XE Software", "range": "16.12.1" }, { "product": "Cisco IOS XE Software", "range": "16.12.1s" }, { "product": "Cisco IOS XE Software", "range": "16.12.1a" }, { "product": "Cisco IOS XE Software", "range": "16.12.1c" }, { "product": "Cisco IOS XE Software", "range": "16.12.1w" }, { "product": "Cisco IOS XE Software", "range": "16.12.2" }, { "product": "Cisco IOS XE Software", "range": "16.12.1y" }, { "product": "Cisco IOS XE Software", "range": "16.12.2a" }, { "product": "Cisco IOS XE Software", "range": "16.12.3" }, { "product": "Cisco IOS XE Software", "range": "16.12.8" }, { "product": "Cisco IOS XE Software", "range": "16.12.2s" }, { "product": "Cisco IOS XE Software", "range": "16.12.1x" }, { "product": "Cisco IOS XE Software", "range": "16.12.1t" }, { "product": "Cisco IOS XE Software", "range": "16.12.4" }, { "product": "Cisco IOS XE Software", "range": "16.12.3s" }, { "product": "Cisco IOS XE Software", "range": "16.12.3a" }, { "product": "Cisco IOS XE Software", "range": "16.12.4a" }, { "product": "Cisco IOS XE Software", "range": "16.12.5" }, { "product": "Cisco IOS XE Software", "range": "16.12.6" }, { "product": "Cisco IOS XE Software", "range": "16.12.1z1" }, { "product": "Cisco IOS XE Software", "range": "16.12.5a" }, { "product": "Cisco IOS XE Software", "range": "16.12.5b" }, { "product": "Cisco IOS XE Software", "range": "16.12.1z2" }, { "product": "Cisco IOS XE Software", "range": "16.12.6a" }, { "product": "Cisco IOS XE Software", "range": "16.12.7" }, { "product": "Cisco IOS XE Software", "range": "16.12.9" }, { "product": "Cisco IOS XE Software", "range": "16.12.10" }, { "product": "Cisco IOS XE Software", "range": "17.1.1" }, { "product": "Cisco IOS XE Software", "range": "17.1.1a" }, { "product": "Cisco IOS XE Software", "range": "17.1.1s" }, { "product": "Cisco IOS XE Software", "range": "17.1.1t" }, { "product": "Cisco IOS XE Software", "range": "17.1.3" }, { "product": "Cisco IOS XE Software", "range": "17.2.1" }, { "product": "Cisco IOS XE Software", "range": "17.2.1r" }, { "product": "Cisco IOS XE Software", "range": "17.2.1a" }, { "product": "Cisco IOS XE Software", "range": "17.2.1v" }, { "product": "Cisco IOS XE Software", "range": "17.2.2" }, { "product": "Cisco IOS XE Software", "range": "17.2.3" }, { "product": "Cisco IOS XE Software", "range": "17.3.1" }, { "product": "Cisco IOS XE Software", "range": "17.3.2" }, { "product": "Cisco IOS XE Software", "range": "17.3.3" }, { "product": "Cisco IOS XE Software", "range": "17.3.1a" }, { "product": "Cisco IOS XE Software", "range": "17.3.1w" }, { "product": "Cisco IOS XE Software", "range": "17.3.2a" }, { "product": "Cisco IOS XE Software", "range": "17.3.1x" }, { "product": "Cisco IOS XE Software", "range": "17.3.1z" }, { "product": "Cisco IOS XE Software", "range": "17.3.4" }, { "product": "Cisco IOS XE Software", "range": "17.3.5" }, { "product": "Cisco IOS XE Software", "range": "17.3.4a" }, { "product": "Cisco IOS XE Software", "range": "17.3.6" }, { "product": "Cisco IOS XE Software", "range": "17.3.4b" }, { "product": "Cisco IOS XE Software", "range": "17.3.4c" }, { "product": "Cisco IOS XE Software", "range": "17.3.5a" }, { "product": "Cisco IOS XE Software", "range": "17.3.5b" }, { "product": "Cisco IOS XE Software", "range": "17.3.7" }, { "product": "Cisco IOS XE Software", "range": "17.3.8" }, { "product": "Cisco IOS XE Software", "range": "17.4.1" }, { "product": "Cisco IOS XE Software", "range": "17.4.2" }, { "product": "Cisco IOS XE Software", "range": "17.4.1a" }, { "product": "Cisco IOS XE Software", "range": "17.4.1b" }, { "product": "Cisco IOS XE Software", "range": "17.4.2a" }, { "product": "Cisco IOS XE Software", "range": "17.5.1" }, { "product": "Cisco IOS XE Software", "range": "17.5.1a" }, { "product": "Cisco IOS XE Software", "range": "17.5.1b" }, { "product": "Cisco IOS XE Software", "range": "17.5.1c" }, { "product": "Cisco IOS XE Software", "range": "17.6.1" }, { "product": "Cisco IOS XE Software", "range": "17.6.2" }, { "product": "Cisco IOS XE Software", "range": "17.6.1w" }, { "product": "Cisco IOS XE Software", "range": "17.6.1a" }, { "product": "Cisco IOS XE Software", "range": "17.6.1x" }, { "product": "Cisco IOS XE Software", "range": "17.6.3" }, { "product": "Cisco IOS XE Software", "range": "17.6.1y" }, { "product": "Cisco IOS XE Software", "range": "17.6.1z" }, { "product": "Cisco IOS XE Software", "range": "17.6.3a" }, { "product": "Cisco IOS XE Software", "range": "17.6.4" }, { "product": "Cisco IOS XE Software", "range": "17.6.1z1" }, { "product": "Cisco IOS XE Software", "range": "17.6.5" }, { "product": "Cisco IOS XE Software", "range": "17.6.6" }, { "product": "Cisco IOS XE Software", "range": "17.7.1" }, { "product": "Cisco IOS XE Software", "range": "17.7.1a" }, { "product": "Cisco IOS XE Software", "range": "17.7.1b" }, { "product": "Cisco IOS XE Software", "range": "17.7.2" }, { "product": "Cisco IOS XE Software", "range": "17.10.1" }, { "product": "Cisco IOS XE Software", "range": "17.10.1a" }, { "product": "Cisco IOS XE Software", "range": "17.10.1b" }, { "product": "Cisco IOS XE Software", "range": "17.8.1" }, { "product": "Cisco IOS XE Software", "range": "17.8.1a" }, { "product": "Cisco IOS XE Software", "range": "17.9.1" }, { "product": "Cisco IOS XE Software", "range": "17.9.1w" }, { "product": "Cisco IOS XE Software", "range": "17.9.2" }, { "product": "Cisco IOS XE Software", "range": "17.9.1a" }, { "product": "Cisco IOS XE Software", "range": "17.9.1x" }, { "product": "Cisco IOS XE Software", "range": "17.9.1y" }, { "product": "Cisco IOS XE Software", "range": "17.9.3" }, { "product": "Cisco IOS XE Software", "range": "17.9.2a" }, { "product": "Cisco IOS XE Software", "range": "17.9.1x1" }, { "product": "Cisco IOS XE Software", "range": "17.9.3a" }, { "product": "Cisco IOS XE Software", "range": "17.9.4" }, { "product": "Cisco IOS XE Software", "range": "17.9.1y1" }, { "product": "Cisco IOS XE Software", "range": "17.11.1" }, { "product": "Cisco IOS XE Software", "range": "17.11.1a" }, { "product": "Cisco IOS XE Software", "range": "17.12.1" }, { "product": "Cisco IOS XE Software", "range": "17.12.1a" }, { "product": "Cisco IOS XE Software", "range": "17.11.99SW" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-20273", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20273", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-10-24T14:13:36.311Z", "modifiedAt": "2025-10-21T23:05:33.896Z", "fetchedAt": "2026-10-24T05:26:29.530Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [ { "version": "16.1.1", "status": "affected" }, { "version": "16.1.2", "status": "affected" }, { "version": "16.1.3", "status": "affected" }, { "version": "16.2.1", "status": "affected" }, { "version": "16.2.2", "status": "affected" }, { "version": "16.3.1", "status": "affected" }, { "version": "16.3.2", "status": "affected" }, { "version": "16.3.3", "status": "affected" }, { "version": "16.3.1a", "status": "affected" }, { "version": "16.3.4", "status": "affected" }, { "version": "16.3.5", "status": "affected" }, { "version": "16.3.5b", "status": "affected" }, { "version": "16.3.6", "status": "affected" }, { "version": "16.3.7", "status": "affected" }, { "version": "16.3.8", "status": "affected" }, { "version": "16.3.9", "status": "affected" }, { "version": "16.3.10", "status": "affected" }, { "version": "16.3.11", "status": "affected" }, { "version": "16.4.1", "status": "affected" }, { "version": "16.4.2", "status": "affected" }, { "version": "16.4.3", "status": "affected" }, { "version": "16.5.1", "status": "affected" }, { "version": "16.5.1a", "status": "affected" }, { "version": "16.5.1b", "status": "affected" }, { "version": "16.5.2", "status": "affected" }, { "version": "16.5.3", "status": "affected" }, { "version": "16.6.1", "status": "affected" }, { "version": "16.6.2", "status": "affected" }, { "version": "16.6.3", "status": "affected" }, { "version": "16.6.4", "status": "affected" }, { "version": "16.6.5", "status": "affected" }, { "version": "16.6.4a", "status": "affected" }, { "version": "16.6.5a", "status": "affected" }, { "version": "16.6.6", "status": "affected" }, { "version": "16.6.7", "status": "affected" }, { "version": "16.6.8", "status": "affected" }, { "version": "16.6.9", "status": "affected" }, { "version": "16.6.10", "status": "affected" }, { "version": "16.7.1", "status": "affected" }, { "version": "16.7.1a", "status": "affected" }, { "version": "16.7.1b", "status": "affected" }, { "version": "16.7.2", "status": "affected" }, { "version": "16.7.3", "status": "affected" }, { "version": "16.7.4", "status": "affected" }, { "version": "16.8.1", "status": "affected" }, { "version": "16.8.1a", "status": "affected" }, { "version": "16.8.1b", "status": "affected" }, { "version": "16.8.1s", "status": "affected" }, { "version": "16.8.1c", "status": "affected" }, { "version": "16.8.1d", "status": "affected" }, { "version": "16.8.2", "status": "affected" }, { "version": "16.8.1e", "status": "affected" }, { "version": "16.8.3", "status": "affected" }, { "version": "16.9.1", "status": "affected" }, { "version": "16.9.2", "status": "affected" }, { "version": "16.9.1a", "status": "affected" }, { "version": "16.9.1b", "status": "affected" }, { "version": "16.9.1s", "status": "affected" }, { "version": "16.9.3", "status": "affected" }, { "version": "16.9.4", "status": "affected" }, { "version": "16.9.3a", "status": "affected" }, { "version": "16.9.5", "status": "affected" }, { "version": "16.9.5f", "status": "affected" }, { "version": "16.9.6", "status": "affected" }, { "version": "16.9.7", "status": "affected" }, { "version": "16.9.8", "status": "affected" }, { "version": "16.10.1", "status": "affected" }, { "version": "16.10.1a", "status": "affected" }, { "version": "16.10.1b", "status": "affected" }, { "version": "16.10.1s", "status": "affected" }, { "version": "16.10.1c", "status": "affected" }, { "version": "16.10.1e", "status": "affected" }, { "version": "16.10.1d", "status": "affected" }, { "version": "16.10.2", "status": "affected" }, { "version": "16.10.1f", "status": "affected" }, { "version": "16.10.1g", "status": "affected" }, { "version": "16.10.3", "status": "affected" }, { "version": "16.11.1", "status": "affected" }, { "version": "16.11.1a", "status": "affected" }, { "version": "16.11.1b", "status": "affected" }, { "version": "16.11.2", "status": "affected" }, { "version": "16.11.1s", "status": "affected" }, { "version": "16.12.1", "status": "affected" }, { "version": "16.12.1s", "status": "affected" }, { "version": "16.12.1a", "status": "affected" }, { "version": "16.12.1c", "status": "affected" }, { "version": "16.12.1w", "status": "affected" }, { "version": "16.12.2", "status": "affected" }, { "version": "16.12.1y", "status": "affected" }, { "version": "16.12.2a", "status": "affected" }, { "version": "16.12.3", "status": "affected" }, { "version": "16.12.8", "status": "affected" }, { "version": "16.12.2s", "status": "affected" }, { "version": "16.12.1x", "status": "affected" }, { "version": "16.12.1t", "status": "affected" }, { "version": "16.12.4", "status": "affected" }, { "version": "16.12.3s", "status": "affected" }, { "version": "16.12.3a", "status": "affected" }, { "version": "16.12.4a", "status": "affected" }, { "version": "16.12.5", "status": "affected" }, { "version": "16.12.6", "status": "affected" }, { "version": "16.12.1z1", "status": "affected" }, { "version": "16.12.5a", "status": "affected" }, { "version": "16.12.5b", "status": "affected" }, { "version": "16.12.1z2", "status": "affected" }, { "version": "16.12.6a", "status": "affected" }, { "version": "16.12.7", "status": "affected" }, { "version": "16.12.9", "status": "affected" }, { "version": "16.12.10", "status": "affected" }, { "version": "17.1.1", "status": "affected" }, { "version": "17.1.1a", "status": "affected" }, { "version": "17.1.1s", "status": "affected" }, { "version": "17.1.1t", "status": "affected" }, { "version": "17.1.3", "status": "affected" }, { "version": "17.2.1", "status": "affected" }, { "version": "17.2.1r", "status": "affected" }, { "version": "17.2.1a", "status": "affected" }, { "version": "17.2.1v", "status": "affected" }, { "version": "17.2.2", "status": "affected" }, { "version": "17.2.3", "status": "affected" }, { "version": "17.3.1", "status": "affected" }, { "version": "17.3.2", "status": "affected" }, { "version": "17.3.3", "status": "affected" }, { "version": "17.3.1a", "status": "affected" }, { "version": "17.3.1w", "status": "affected" }, { "version": "17.3.2a", "status": "affected" }, { "version": "17.3.1x", "status": "affected" }, { "version": "17.3.1z", "status": "affected" }, { "version": "17.3.4", "status": "affected" }, { "version": "17.3.5", "status": "affected" }, { "version": "17.3.4a", "status": "affected" }, { "version": "17.3.6", "status": "affected" }, { "version": "17.3.4b", "status": "affected" }, { "version": "17.3.4c", "status": "affected" }, { "version": "17.3.5a", "status": "affected" }, { "version": "17.3.5b", "status": "affected" }, { "version": "17.3.7", "status": "affected" }, { "version": "17.3.8", "status": "affected" }, { "version": "17.4.1", "status": "affected" }, { "version": "17.4.2", "status": "affected" }, { "version": "17.4.1a", "status": "affected" }, { "version": "17.4.1b", "status": "affected" }, { "version": "17.4.2a", "status": "affected" }, { "version": "17.5.1", "status": "affected" }, { "version": "17.5.1a", "status": "affected" }, { "version": "17.5.1b", "status": "affected" }, { "version": "17.5.1c", "status": "affected" }, { "version": "17.6.1", "status": "affected" }, { "version": "17.6.2", "status": "affected" }, { "version": "17.6.1w", "status": "affected" }, { "version": "17.6.1a", "status": "affected" }, { "version": "17.6.1x", "status": "affected" }, { "version": "17.6.3", "status": "affected" }, { "version": "17.6.1y", "status": "affected" }, { "version": "17.6.1z", "status": "affected" }, { "version": "17.6.3a", "status": "affected" }, { "version": "17.6.4", "status": "affected" }, { "version": "17.6.1z1", "status": "affected" }, { "version": "17.6.5", "status": "affected" }, { "version": "17.6.6", "status": "affected" }, { "version": "17.7.1", "status": "affected" }, { "version": "17.7.1a", "status": "affected" }, { "version": "17.7.1b", "status": "affected" }, { "version": "17.7.2", "status": "affected" }, { "version": "17.10.1", "status": "affected" }, { "version": "17.10.1a", "status": "affected" }, { "version": "17.10.1b", "status": "affected" }, { "version": "17.8.1", "status": "affected" }, { "version": "17.8.1a", "status": "affected" }, { "version": "17.9.1", "status": "affected" }, { "version": "17.9.1w", "status": "affected" }, { "version": "17.9.2", "status": "affected" }, { "version": "17.9.1a", "status": "affected" }, { "version": "17.9.1x", "status": "affected" }, { "version": "17.9.1y", "status": "affected" }, { "version": "17.9.3", "status": "affected" }, { "version": "17.9.2a", "status": "affected" }, { "version": "17.9.1x1", "status": "affected" }, { "version": "17.9.3a", "status": "affected" }, { "version": "17.9.4", "status": "affected" }, { "version": "17.9.1y1", "status": "affected" }, { "version": "17.11.1", "status": "affected" }, { "version": "17.11.1a", "status": "affected" }, { "version": "17.12.1", "status": "affected" }, { "version": "17.12.1a", "status": "affected" }, { "version": "17.11.99SW", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-20273", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json", "fetchedAt": "2026-10-24T05:26:29.530Z", "publishedAt": "2023-10-24T14:13:36.311Z", "modifiedAt": "2025-10-21T23:05:33.896Z", "state": "published", "provider": "cisco", "title": "", "descriptions": [ { "lang": "en", "value": "A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco IOS XE Software", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "16.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "16.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "16.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "16.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "16.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "16.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "16.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "16.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "16.3.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "16.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "16.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "16.3.5b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "16.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "16.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "16.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "16.3.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "16.3.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "16.3.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "16.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "16.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "16.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "16.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "16.5.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "16.5.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "16.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "16.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "16.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "16.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "16.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "16.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "16.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/31", "version": "16.6.4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/32", "version": "16.6.5a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/33", "version": "16.6.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/34", "version": "16.6.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/35", "version": "16.6.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/36", "version": "16.6.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/37", "version": "16.6.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/38", "version": "16.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/39", "version": "16.7.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/40", "version": "16.7.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/41", "version": "16.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/42", "version": "16.7.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/43", "version": "16.7.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/44", "version": "16.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/45", "version": "16.8.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/46", "version": "16.8.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/47", "version": "16.8.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/48", "version": "16.8.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/49", "version": "16.8.1d", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/50", "version": "16.8.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/51", "version": "16.8.1e", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/52", "version": "16.8.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/53", "version": "16.9.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/54", "version": "16.9.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/55", "version": "16.9.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/56", "version": "16.9.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/57", "version": "16.9.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/58", "version": "16.9.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/59", "version": "16.9.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/60", "version": "16.9.3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/61", "version": "16.9.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/62", "version": "16.9.5f", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/63", "version": "16.9.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/64", "version": "16.9.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/65", "version": "16.9.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/66", "version": "16.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/67", "version": "16.10.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/68", "version": "16.10.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/69", "version": "16.10.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/70", "version": "16.10.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/71", "version": "16.10.1e", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/72", "version": "16.10.1d", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/73", "version": "16.10.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/74", "version": "16.10.1f", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/75", "version": "16.10.1g", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/76", "version": "16.10.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/77", "version": "16.11.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/78", "version": "16.11.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/79", "version": "16.11.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/80", "version": "16.11.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/81", "version": "16.11.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/82", "version": "16.12.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/83", "version": "16.12.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/84", "version": "16.12.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/85", "version": "16.12.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/86", "version": "16.12.1w", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/87", "version": "16.12.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/88", "version": "16.12.1y", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/89", "version": "16.12.2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/90", "version": "16.12.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/91", "version": "16.12.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/92", "version": "16.12.2s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/93", "version": "16.12.1x", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/94", "version": "16.12.1t", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/95", "version": "16.12.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/96", "version": "16.12.3s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/97", "version": "16.12.3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/98", "version": "16.12.4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/99", "version": "16.12.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/100", "version": "16.12.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/101", "version": "16.12.1z1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/102", "version": "16.12.5a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/103", "version": "16.12.5b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/104", "version": "16.12.1z2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/105", "version": "16.12.6a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/106", "version": "16.12.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/107", "version": "16.12.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/108", "version": "16.12.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/109", "version": "17.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/110", "version": "17.1.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/111", "version": "17.1.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/112", "version": "17.1.1t", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/113", "version": "17.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/114", "version": "17.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/115", "version": "17.2.1r", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/116", "version": "17.2.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/117", "version": "17.2.1v", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/118", "version": "17.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/119", "version": "17.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/120", "version": "17.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/121", "version": "17.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/122", "version": "17.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/123", "version": "17.3.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/124", "version": "17.3.1w", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/125", "version": "17.3.2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/126", "version": "17.3.1x", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/127", "version": "17.3.1z", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/128", "version": "17.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/129", "version": "17.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/130", "version": "17.3.4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/131", "version": "17.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/132", "version": "17.3.4b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/133", "version": "17.3.4c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/134", "version": "17.3.5a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/135", "version": "17.3.5b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/136", "version": "17.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/137", "version": "17.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/138", "version": "17.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/139", "version": "17.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/140", "version": "17.4.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/141", "version": "17.4.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/142", "version": "17.4.2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/143", "version": "17.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/144", "version": "17.5.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/145", "version": "17.5.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/146", "version": "17.5.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/147", "version": "17.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/148", "version": "17.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/149", "version": "17.6.1w", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/150", "version": "17.6.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/151", "version": "17.6.1x", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/152", "version": "17.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/153", "version": "17.6.1y", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/154", "version": "17.6.1z", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/155", "version": "17.6.3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/156", "version": "17.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/157", "version": "17.6.1z1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/158", "version": "17.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/159", "version": "17.6.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/160", "version": "17.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/161", "version": "17.7.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/162", "version": "17.7.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/163", "version": "17.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/164", "version": "17.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/165", "version": "17.10.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/166", "version": "17.10.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/167", "version": "17.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/168", "version": "17.8.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/169", "version": "17.9.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/170", "version": "17.9.1w", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/171", "version": "17.9.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/172", "version": "17.9.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/173", "version": "17.9.1x", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/174", "version": "17.9.1y", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/175", "version": "17.9.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/176", "version": "17.9.2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/177", "version": "17.9.1x1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/178", "version": "17.9.3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/179", "version": "17.9.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/180", "version": "17.9.1y1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/181", "version": "17.11.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/182", "version": "17.11.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/183", "version": "17.12.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/184", "version": "17.12.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/185", "version": "17.11.99SW", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "Cisco is aware of active exploitation of these vulnerabilities.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "label": "cisco-sa-iosxe-webui-privesc-j22SaA4z", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20273", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco IOS XE Software\",\"versions\":[{\"version\":\"16.1.1\",\"status\":\"affected\"},{\"version\":\"16.1.2\",\"status\":\"affected\"},{\"version\":\"16.1.3\",\"status\":\"affected\"},{\"version\":\"16.2.1\",\"status\":\"affected\"},{\"version\":\"16.2.2\",\"status\":\"affected\"},{\"version\":\"16.3.1\",\"status\":\"affected\"},{\"version\":\"16.3.2\",\"status\":\"affected\"},{\"version\":\"16.3.3\",\"status\":\"affected\"},{\"version\":\"16.3.1a\",\"status\":\"affected\"},{\"version\":\"16.3.4\",\"status\":\"affected\"},{\"version\":\"16.3.5\",\"status\":\"affected\"},{\"version\":\"16.3.5b\",\"status\":\"affected\"},{\"version\":\"16.3.6\",\"status\":\"affected\"},{\"version\":\"16.3.7\",\"status\":\"affected\"},{\"version\":\"16.3.8\",\"status\":\"affected\"},{\"version\":\"16.3.9\",\"status\":\"affected\"},{\"version\":\"16.3.10\",\"status\":\"affected\"},{\"version\":\"16.3.11\",\"status\":\"affected\"},{\"version\":\"16.4.1\",\"status\":\"affected\"},{\"version\":\"16.4.2\",\"status\":\"affected\"},{\"version\":\"16.4.3\",\"status\":\"affected\"},{\"version\":\"16.5.1\",\"status\":\"affected\"},{\"version\":\"16.5.1a\",\"status\":\"affected\"},{\"version\":\"16.5.1b\",\"status\":\"affected\"},{\"version\":\"16.5.2\",\"status\":\"affected\"},{\"version\":\"16.5.3\",\"status\":\"affected\"},{\"version\":\"16.6.1\",\"status\":\"affected\"},{\"version\":\"16.6.2\",\"status\":\"affected\"},{\"version\":\"16.6.3\",\"status\":\"affected\"},{\"version\":\"16.6.4\",\"status\":\"affected\"},{\"version\":\"16.6.5\",\"status\":\"affected\"},{\"version\":\"16.6.4a\",\"status\":\"affected\"},{\"version\":\"16.6.5a\",\"status\":\"affected\"},{\"version\":\"16.6.6\",\"status\":\"affected\"},{\"version\":\"16.6.7\",\"status\":\"affected\"},{\"version\":\"16.6.8\",\"status\":\"affected\"},{\"version\":\"16.6.9\",\"status\":\"affected\"},{\"version\":\"16.6.10\",\"status\":\"affected\"},{\"version\":\"16.7.1\",\"status\":\"affected\"},{\"version\":\"16.7.1a\",\"status\":\"affected\"},{\"version\":\"16.7.1b\",\"status\":\"affected\"},{\"version\":\"16.7.2\",\"status\":\"affected\"},{\"version\":\"16.7.3\",\"status\":\"affected\"},{\"version\":\"16.7.4\",\"status\":\"affected\"},{\"version\":\"16.8.1\",\"status\":\"affected\"},{\"version\":\"16.8.1a\",\"status\":\"affected\"},{\"version\":\"16.8.1b\",\"status\":\"affected\"},{\"version\":\"16.8.1s\",\"status\":\"affected\"},{\"version\":\"16.8.1c\",\"status\":\"affected\"},{\"version\":\"16.8.1d\",\"status\":\"affected\"},{\"version\":\"16.8.2\",\"status\":\"affected\"},{\"version\":\"16.8.1e\",\"status\":\"affected\"},{\"version\":\"16.8.3\",\"status\":\"affected\"},{\"version\":\"16.9.1\",\"status\":\"affected\"},{\"version\":\"16.9.2\",\"status\":\"affected\"},{\"version\":\"16.9.1a\",\"status\":\"affected\"},{\"version\":\"16.9.1b\",\"status\":\"affected\"},{\"version\":\"16.9.1s\",\"status\":\"affected\"},{\"version\":\"16.9.3\",\"status\":\"affected\"},{\"version\":\"16.9.4\",\"status\":\"affected\"},{\"version\":\"16.9.3a\",\"status\":\"affected\"},{\"version\":\"16.9.5\",\"status\":\"affected\"},{\"version\":\"16.9.5f\",\"status\":\"affected\"},{\"version\":\"16.9.6\",\"status\":\"affected\"},{\"version\":\"16.9.7\",\"status\":\"affected\"},{\"version\":\"16.9.8\",\"status\":\"affected\"},{\"version\":\"16.10.1\",\"status\":\"affected\"},{\"version\":\"16.10.1a\",\"status\":\"affected\"},{\"version\":\"16.10.1b\",\"status\":\"affected\"},{\"version\":\"16.10.1s\",\"status\":\"affected\"},{\"version\":\"16.10.1c\",\"status\":\"affected\"},{\"version\":\"16.10.1e\",\"status\":\"affected\"},{\"version\":\"16.10.1d\",\"status\":\"affected\"},{\"version\":\"16.10.2\",\"status\":\"affected\"},{\"version\":\"16.10.1f\",\"status\":\"affected\"},{\"version\":\"16.10.1g\",\"status\":\"affected\"},{\"version\":\"16.10.3\",\"status\":\"affected\"},{\"version\":\"16.11.1\",\"status\":\"affected\"},{\"version\":\"16.11.1a\",\"status\":\"affected\"},{\"version\":\"16.11.1b\",\"status\":\"affected\"},{\"version\":\"16.11.2\",\"status\":\"affected\"},{\"version\":\"16.11.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1\",\"status\":\"affected\"},{\"version\":\"16.12.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1a\",\"status\":\"affected\"},{\"version\":\"16.12.1c\",\"status\":\"affected\"},{\"version\":\"16.12.1w\",\"status\":\"affected\"},{\"version\":\"16.12.2\",\"status\":\"affected\"},{\"version\":\"16.12.1y\",\"status\":\"affected\"},{\"version\":\"16.12.2a\",\"status\":\"affected\"},{\"version\":\"16.12.3\",\"status\":\"affected\"},{\"version\":\"16.12.8\",\"status\":\"affected\"},{\"version\":\"16.12.2s\",\"status\":\"affected\"},{\"version\":\"16.12.1x\",\"status\":\"affected\"},{\"version\":\"16.12.1t\",\"status\":\"affected\"},{\"version\":\"16.12.4\",\"status\":\"affected\"},{\"version\":\"16.12.3s\",\"status\":\"affected\"},{\"version\":\"16.12.3a\",\"status\":\"affected\"},{\"version\":\"16.12.4a\",\"status\":\"affected\"},{\"version\":\"16.12.5\",\"status\":\"affected\"},{\"version\":\"16.12.6\",\"status\":\"affected\"},{\"version\":\"16.12.1z1\",\"status\":\"affected\"},{\"version\":\"16.12.5a\",\"status\":\"affected\"},{\"version\":\"16.12.5b\",\"status\":\"affected\"},{\"version\":\"16.12.1z2\",\"status\":\"affected\"},{\"version\":\"16.12.6a\",\"status\":\"affected\"},{\"version\":\"16.12.7\",\"status\":\"affected\"},{\"version\":\"16.12.9\",\"status\":\"affected\"},{\"version\":\"16.12.10\",\"status\":\"affected\"},{\"version\":\"17.1.1\",\"status\":\"affected\"},{\"version\":\"17.1.1a\",\"status\":\"affected\"},{\"version\":\"17.1.1s\",\"status\":\"affected\"},{\"version\":\"17.1.1t\",\"status\":\"affected\"},{\"version\":\"17.1.3\",\"status\":\"affected\"},{\"version\":\"17.2.1\",\"status\":\"affected\"},{\"version\":\"17.2.1r\",\"status\":\"affected\"},{\"version\":\"17.2.1a\",\"status\":\"affected\"},{\"version\":\"17.2.1v\",\"status\":\"affected\"},{\"version\":\"17.2.2\",\"status\":\"affected\"},{\"version\":\"17.2.3\",\"status\":\"affected\"},{\"version\":\"17.3.1\",\"status\":\"affected\"},{\"version\":\"17.3.2\",\"status\":\"affected\"},{\"version\":\"17.3.3\",\"status\":\"affected\"},{\"version\":\"17.3.1a\",\"status\":\"affected\"},{\"version\":\"17.3.1w\",\"status\":\"affected\"},{\"version\":\"17.3.2a\",\"status\":\"affected\"},{\"version\":\"17.3.1x\",\"status\":\"affected\"},{\"version\":\"17.3.1z\",\"status\":\"affected\"},{\"version\":\"17.3.4\",\"status\":\"affected\"},{\"version\":\"17.3.5\",\"status\":\"affected\"},{\"version\":\"17.3.4a\",\"status\":\"affected\"},{\"version\":\"17.3.6\",\"status\":\"affected\"},{\"version\":\"17.3.4b\",\"status\":\"affected\"},{\"version\":\"17.3.4c\",\"status\":\"affected\"},{\"version\":\"17.3.5a\",\"status\":\"affected\"},{\"version\":\"17.3.5b\",\"status\":\"affected\"},{\"version\":\"17.3.7\",\"status\":\"affected\"},{\"version\":\"17.3.8\",\"status\":\"affected\"},{\"version\":\"17.4.1\",\"status\":\"affected\"},{\"version\":\"17.4.2\",\"status\":\"affected\"},{\"version\":\"17.4.1a\",\"status\":\"affected\"},{\"version\":\"17.4.1b\",\"status\":\"affected\"},{\"version\":\"17.4.2a\",\"status\":\"affected\"},{\"version\":\"17.5.1\",\"status\":\"affected\"},{\"version\":\"17.5.1a\",\"status\":\"affected\"},{\"version\":\"17.5.1b\",\"status\":\"affected\"},{\"version\":\"17.5.1c\",\"status\":\"affected\"},{\"version\":\"17.6.1\",\"status\":\"affected\"},{\"version\":\"17.6.2\",\"status\":\"affected\"},{\"version\":\"17.6.1w\",\"status\":\"affected\"},{\"version\":\"17.6.1a\",\"status\":\"affected\"},{\"version\":\"17.6.1x\",\"status\":\"affected\"},{\"version\":\"17.6.3\",\"status\":\"affected\"},{\"version\":\"17.6.1y\",\"status\":\"affected\"},{\"version\":\"17.6.1z\",\"status\":\"affected\"},{\"version\":\"17.6.3a\",\"status\":\"affected\"},{\"version\":\"17.6.4\",\"status\":\"affected\"},{\"version\":\"17.6.1z1\",\"status\":\"affected\"},{\"version\":\"17.6.5\",\"status\":\"affected\"},{\"version\":\"17.6.6\",\"status\":\"affected\"},{\"version\":\"17.7.1\",\"status\":\"affected\"},{\"version\":\"17.7.1a\",\"status\":\"affected\"},{\"version\":\"17.7.1b\",\"status\":\"affected\"},{\"version\":\"17.7.2\",\"status\":\"affected\"},{\"version\":\"17.10.1\",\"status\":\"affected\"},{\"version\":\"17.10.1a\",\"status\":\"affected\"},{\"version\":\"17.10.1b\",\"status\":\"affected\"},{\"version\":\"17.8.1\",\"status\":\"affected\"},{\"version\":\"17.8.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1\",\"status\":\"affected\"},{\"version\":\"17.9.1w\",\"status\":\"affected\"},{\"version\":\"17.9.2\",\"status\":\"affected\"},{\"version\":\"17.9.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1x\",\"status\":\"affected\"},{\"version\":\"17.9.1y\",\"status\":\"affected\"},{\"version\":\"17.9.3\",\"status\":\"affected\"},{\"version\":\"17.9.2a\",\"status\":\"affected\"},{\"version\":\"17.9.1x1\",\"status\":\"affected\"},{\"version\":\"17.9.3a\",\"status\":\"affected\"},{\"version\":\"17.9.4\",\"status\":\"affected\"},{\"version\":\"17.9.1y1\",\"status\":\"affected\"},{\"version\":\"17.11.1\",\"status\":\"affected\"},{\"version\":\"17.11.1a\",\"status\":\"affected\"},{\"version\":\"17.12.1\",\"status\":\"affected\"},{\"version\":\"17.12.1a\",\"status\":\"affected\"},{\"version\":\"17.11.99SW\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "Cisco is aware of active exploitation of these vulnerabilities.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"type\":\"cwe\",\"cweId\":\"CWE-78\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-20273:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "sourcePath": "retained:/originalText", "text": "Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-20273:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "sourcePath": "retained:/sourceAction", "text": "Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "modifiedAt": "2023-10-23T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:33.896Z", "fetchedAt": "2026-10-24T05:26:29.530Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-10-23T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.", "sourceSummary": "Cisco IOS XE Softwareに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:26:29.530Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "2b372a574faaa54b8b72b891c60a2f81d5ea87ca4b998477da5758472a3f440d", "sourceModifiedAt": "2025-10-21T23:05:33.896Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco IOS XE Software の Web UI 機能において、入力検証が不十分なため、認証されたリモート攻撃者が root 権限でコマンドを注入できる脆弱性があります。攻撃者は Web UI に細工した入力を送信することで、この脆弱性を悪用できます。成功すると、攻撃者は基盤となるオペレーティングシステムに対して root 権限でコマンドを実行できるようになります。", "risk": "攻撃者がこの脆弱性を利用すると、root 権限でコマンドを実行できるため、システム全体を支配されたり、重要な設定やデータを改ざん・削除されたりする可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者は認証されたリモートユーザーである必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者は Web UI に細工した入力を送信できる必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Cisco / Cisco IOS XE Software。影響ありとして記載：16.1.1。影響ありとして記載：16.1.2。影響ありとして記載：16.1.3。影響ありとして記載：16.2.1。影響ありとして記載：16.2.2。影響ありとして記載：16.3.1。影響ありとして記載：16.3.2。影響ありとして記載：16.3.3。影響ありとして記載：16.3.1a。影響ありとして記載：16.3.4。影響ありとして記載：16.3.5。影響ありとして記載：16.3.5b。影響ありとして記載：16.3.6。影響ありとして記載：16.3.7。影響ありとして記載：16.3.8。影響ありとして記載：16.3.9。影響ありとして記載：16.3.10。影響ありとして記載：16.3.11。影響ありとして記載：16.4.1。影響ありとして記載：16.4.2。影響ありとして記載：16.4.3。影響ありとして記載：16.5.1。影響ありとして記載：16.5.1a。影響ありとして記載：16.5.1b。影響ありとして記載：16.5.2。影響ありとして記載：16.5.3。影響ありとして記載：16.6.1。影響ありとして記載：16.6.2。影響ありとして記載：16.6.3。影響ありとして記載：16.6.4。影響ありとして記載：16.6.5。影響ありとして記載：16.6.4a。影響ありとして記載：16.6.5a。影響ありとして記載：16.6.6。影響ありとして記載：16.6.7。影響ありとして記載：16.6.8。影響ありとして記載：16.6.9。影響ありとして記載：16.6.10。影響ありとして記載：16.7.1。影響ありとして記載：16.7.1a。影響ありとして記載：16.7.1b。影響ありとして記載：16.7.2。影響ありとして記載：16.7.3。影響ありとして記載：16.7.4。影響ありとして記載：16.8.1。影響ありとして記載：16.8.1a。影響ありとして記載：16.8.1b。影響ありとして記載：16.8.1s。影響ありとして記載：16.8.1c。影響ありとして記載：16.8.1d。影響ありとして記載：16.8.2。影響ありとして記載：16.8.1e。影響ありとして記載：16.8.3。影響ありとして記載：16.9.1。影響ありとして記載：16.9.2。影響ありとして記載：16.9.1a。影響ありとして記載：16.9.1b。影響ありとして記載：16.9.1s。影響ありとして記載：16.9.3。影響ありとして記載：16.9.4。影響ありとして記載：16.9.3a。影響ありとして記載：16.9.5。影響ありとして記載：16.9.5f。影響ありとして記載：16.9.6。影響ありとして記載：16.9.7。影響ありとして記載：16.9.8。影響ありとして記載：16.10.1。影響ありとして記載：16.10.1a。影響ありとして記載：16.10.1b。影響ありとして記載：16.10.1s。影響ありとして記載：16.10.1c。影響ありとして記載：16.10.1e。影響ありとして記載：16.10.1d。影響ありとして記載：16.10.2。影響ありとして記載：16.10.1f。影響ありとして記載：16.10.1g。影響ありとして記載：16.10.3。影響ありとして記載：16.11.1。影響ありとして記載：16.11.1a。影響ありとして記載：16.11.1b。影響ありとして記載：16.11.2。影響ありとして記載：16.11.1s。影響ありとして記載：16.12.1。影響ありとして記載：16.12.1s。影響ありとして記載：16.12.1a。影響ありとして記載：16.12.1c。影響ありとして記載：16.12.1w。影響ありとして記載：16.12.2。影響ありとして記載：16.12.1y。影響ありとして記載：16.12.2a。影響ありとして記載：16.12.3。影響ありとして記載：16.12.8。影響ありとして記載：16.12.2s。影響ありとして記載：16.12.1x。影響ありとして記載：16.12.1t。影響ありとして記載：16.12.4。影響ありとして記載：16.12.3s。影響ありとして記載：16.12.3a。影響ありとして記載：16.12.4a。影響ありとして記載：16.12.5。影響ありとして記載：16.12.6。影響ありとして記載：16.12.1z1。影響ありとして記載：16.12.5a。影響ありとして記載：16.12.5b。影響ありとして記載：16.12.1z2。影響ありとして記載：16.12.6a。影響ありとして記載：16.12.7。影響ありとして記載：16.12.9。影響ありとして記載：16.12.10。影響ありとして記載：17.1.1。影響ありとして記載：17.1.1a。影響ありとして記載：17.1.1s。影響ありとして記載：17.1.1t。影響ありとして記載：17.1.3。影響ありとして記載：17.2.1。影響ありとして記載：17.2.1r。影響ありとして記載：17.2.1a。影響ありとして記載：17.2.1v。影響ありとして記載：17.2.2。影響ありとして記載：17.2.3。影響ありとして記載：17.3.1。影響ありとして記載：17.3.2。影響ありとして記載：17.3.3。影響ありとして記載：17.3.1a。影響ありとして記載：17.3.1w。影響ありとして記載：17.3.2a。影響ありとして記載：17.3.1x。影響ありとして記載：17.3.1z。影響ありとして記載：17.3.4。影響ありとして記載：17.3.5。影響ありとして記載：17.3.4a。影響ありとして記載：17.3.6。影響ありとして記載：17.3.4b。影響ありとして記載：17.3.4c。影響ありとして記載：17.3.5a。影響ありとして記載：17.3.5b。影響ありとして記載：17.3.7。影響ありとして記載：17.3.8。影響ありとして記載：17.4.1。影響ありとして記載：17.4.2。影響ありとして記載：17.4.1a。影響ありとして記載：17.4.1b。影響ありとして記載：17.4.2a。影響ありとして記載：17.5.1。影響ありとして記載：17.5.1a。影響ありとして記載：17.5.1b。影響ありとして記載：17.5.1c。影響ありとして記載：17.6.1。影響ありとして記載：17.6.2。影響ありとして記載：17.6.1w。影響ありとして記載：17.6.1a。影響ありとして記載：17.6.1x。影響ありとして記載：17.6.3。影響ありとして記載：17.6.1y。影響ありとして記載：17.6.1z。影響ありとして記載：17.6.3a。影響ありとして記載：17.6.4。影響ありとして記載：17.6.1z1。影響ありとして記載：17.6.5。影響ありとして記載：17.6.6。影響ありとして記載：17.7.1。影響ありとして記載：17.7.1a。影響ありとして記載：17.7.1b。影響ありとして記載：17.7.2。影響ありとして記載：17.10.1。影響ありとして記載：17.10.1a。影響ありとして記載：17.10.1b。影響ありとして記載：17.8.1。影響ありとして記載：17.8.1a。影響ありとして記載：17.9.1。影響ありとして記載：17.9.1w。影響ありとして記載：17.9.2。影響ありとして記載：17.9.1a。影響ありとして記載：17.9.1x。影響ありとして記載：17.9.1y。影響ありとして記載：17.9.3。影響ありとして記載：17.9.2a。影響ありとして記載：17.9.1x1。影響ありとして記載：17.9.3a。影響ありとして記載：17.9.4。影響ありとして記載：17.9.1y1。影響ありとして記載：17.11.1。影響ありとして記載：17.11.1a。影響ありとして記載：17.12.1。影響ありとして記載：17.12.1a。影響ありとして記載：17.11.99SW。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Cisco IOS XE Software」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-20273", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "https://nvd.nist.gov/vuln/detail/CVE-2023-20273" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-20273", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "https://nvd.nist.gov/vuln/detail/CVE-2023-20273" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-20273", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "https://nvd.nist.gov/vuln/detail/CVE-2023-20273" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-20273", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20273", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20273.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco IOS XE Software\",\"versions\":[{\"version\":\"16.1.1\",\"status\":\"affected\"},{\"version\":\"16.1.2\",\"status\":\"affected\"},{\"version\":\"16.1.3\",\"status\":\"affected\"},{\"version\":\"16.2.1\",\"status\":\"affected\"},{\"version\":\"16.2.2\",\"status\":\"affected\"},{\"version\":\"16.3.1\",\"status\":\"affected\"},{\"version\":\"16.3.2\",\"status\":\"affected\"},{\"version\":\"16.3.3\",\"status\":\"affected\"},{\"version\":\"16.3.1a\",\"status\":\"affected\"},{\"version\":\"16.3.4\",\"status\":\"affected\"},{\"version\":\"16.3.5\",\"status\":\"affected\"},{\"version\":\"16.3.5b\",\"status\":\"affected\"},{\"version\":\"16.3.6\",\"status\":\"affected\"},{\"version\":\"16.3.7\",\"status\":\"affected\"},{\"version\":\"16.3.8\",\"status\":\"affected\"},{\"version\":\"16.3.9\",\"status\":\"affected\"},{\"version\":\"16.3.10\",\"status\":\"affected\"},{\"version\":\"16.3.11\",\"status\":\"affected\"},{\"version\":\"16.4.1\",\"status\":\"affected\"},{\"version\":\"16.4.2\",\"status\":\"affected\"},{\"version\":\"16.4.3\",\"status\":\"affected\"},{\"version\":\"16.5.1\",\"status\":\"affected\"},{\"version\":\"16.5.1a\",\"status\":\"affected\"},{\"version\":\"16.5.1b\",\"status\":\"affected\"},{\"version\":\"16.5.2\",\"status\":\"affected\"},{\"version\":\"16.5.3\",\"status\":\"affected\"},{\"version\":\"16.6.1\",\"status\":\"affected\"},{\"version\":\"16.6.2\",\"status\":\"affected\"},{\"version\":\"16.6.3\",\"status\":\"affected\"},{\"version\":\"16.6.4\",\"status\":\"affected\"},{\"version\":\"16.6.5\",\"status\":\"affected\"},{\"version\":\"16.6.4a\",\"status\":\"affected\"},{\"version\":\"16.6.5a\",\"status\":\"affected\"},{\"version\":\"16.6.6\",\"status\":\"affected\"},{\"version\":\"16.6.7\",\"status\":\"affected\"},{\"version\":\"16.6.8\",\"status\":\"affected\"},{\"version\":\"16.6.9\",\"status\":\"affected\"},{\"version\":\"16.6.10\",\"status\":\"affected\"},{\"version\":\"16.7.1\",\"status\":\"affected\"},{\"version\":\"16.7.1a\",\"status\":\"affected\"},{\"version\":\"16.7.1b\",\"status\":\"affected\"},{\"version\":\"16.7.2\",\"status\":\"affected\"},{\"version\":\"16.7.3\",\"status\":\"affected\"},{\"version\":\"16.7.4\",\"status\":\"affected\"},{\"version\":\"16.8.1\",\"status\":\"affected\"},{\"version\":\"16.8.1a\",\"status\":\"affected\"},{\"version\":\"16.8.1b\",\"status\":\"affected\"},{\"version\":\"16.8.1s\",\"status\":\"affected\"},{\"version\":\"16.8.1c\",\"status\":\"affected\"},{\"version\":\"16.8.1d\",\"status\":\"affected\"},{\"version\":\"16.8.2\",\"status\":\"affected\"},{\"version\":\"16.8.1e\",\"status\":\"affected\"},{\"version\":\"16.8.3\",\"status\":\"affected\"},{\"version\":\"16.9.1\",\"status\":\"affected\"},{\"version\":\"16.9.2\",\"status\":\"affected\"},{\"version\":\"16.9.1a\",\"status\":\"affected\"},{\"version\":\"16.9.1b\",\"status\":\"affected\"},{\"version\":\"16.9.1s\",\"status\":\"affected\"},{\"version\":\"16.9.3\",\"status\":\"affected\"},{\"version\":\"16.9.4\",\"status\":\"affected\"},{\"version\":\"16.9.3a\",\"status\":\"affected\"},{\"version\":\"16.9.5\",\"status\":\"affected\"},{\"version\":\"16.9.5f\",\"status\":\"affected\"},{\"version\":\"16.9.6\",\"status\":\"affected\"},{\"version\":\"16.9.7\",\"status\":\"affected\"},{\"version\":\"16.9.8\",\"status\":\"affected\"},{\"version\":\"16.10.1\",\"status\":\"affected\"},{\"version\":\"16.10.1a\",\"status\":\"affected\"},{\"version\":\"16.10.1b\",\"status\":\"affected\"},{\"version\":\"16.10.1s\",\"status\":\"affected\"},{\"version\":\"16.10.1c\",\"status\":\"affected\"},{\"version\":\"16.10.1e\",\"status\":\"affected\"},{\"version\":\"16.10.1d\",\"status\":\"affected\"},{\"version\":\"16.10.2\",\"status\":\"affected\"},{\"version\":\"16.10.1f\",\"status\":\"affected\"},{\"version\":\"16.10.1g\",\"status\":\"affected\"},{\"version\":\"16.10.3\",\"status\":\"affected\"},{\"version\":\"16.11.1\",\"status\":\"affected\"},{\"version\":\"16.11.1a\",\"status\":\"affected\"},{\"version\":\"16.11.1b\",\"status\":\"affected\"},{\"version\":\"16.11.2\",\"status\":\"affected\"},{\"version\":\"16.11.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1\",\"status\":\"affected\"},{\"version\":\"16.12.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1a\",\"status\":\"affected\"},{\"version\":\"16.12.1c\",\"status\":\"affected\"},{\"version\":\"16.12.1w\",\"status\":\"affected\"},{\"version\":\"16.12.2\",\"status\":\"affected\"},{\"version\":\"16.12.1y\",\"status\":\"affected\"},{\"version\":\"16.12.2a\",\"status\":\"affected\"},{\"version\":\"16.12.3\",\"status\":\"affected\"},{\"version\":\"16.12.8\",\"status\":\"affected\"},{\"version\":\"16.12.2s\",\"status\":\"affected\"},{\"version\":\"16.12.1x\",\"status\":\"affected\"},{\"version\":\"16.12.1t\",\"status\":\"affected\"},{\"version\":\"16.12.4\",\"status\":\"affected\"},{\"version\":\"16.12.3s\",\"status\":\"affected\"},{\"version\":\"16.12.3a\",\"status\":\"affected\"},{\"version\":\"16.12.4a\",\"status\":\"affected\"},{\"version\":\"16.12.5\",\"status\":\"affected\"},{\"version\":\"16.12.6\",\"status\":\"affected\"},{\"version\":\"16.12.1z1\",\"status\":\"affected\"},{\"version\":\"16.12.5a\",\"status\":\"affected\"},{\"version\":\"16.12.5b\",\"status\":\"affected\"},{\"version\":\"16.12.1z2\",\"status\":\"affected\"},{\"version\":\"16.12.6a\",\"status\":\"affected\"},{\"version\":\"16.12.7\",\"status\":\"affected\"},{\"version\":\"16.12.9\",\"status\":\"affected\"},{\"version\":\"16.12.10\",\"status\":\"affected\"},{\"version\":\"17.1.1\",\"status\":\"affected\"},{\"version\":\"17.1.1a\",\"status\":\"affected\"},{\"version\":\"17.1.1s\",\"status\":\"affected\"},{\"version\":\"17.1.1t\",\"status\":\"affected\"},{\"version\":\"17.1.3\",\"status\":\"affected\"},{\"version\":\"17.2.1\",\"status\":\"affected\"},{\"version\":\"17.2.1r\",\"status\":\"affected\"},{\"version\":\"17.2.1a\",\"status\":\"affected\"},{\"version\":\"17.2.1v\",\"status\":\"affected\"},{\"version\":\"17.2.2\",\"status\":\"affected\"},{\"version\":\"17.2.3\",\"status\":\"affected\"},{\"version\":\"17.3.1\",\"status\":\"affected\"},{\"version\":\"17.3.2\",\"status\":\"affected\"},{\"version\":\"17.3.3\",\"status\":\"affected\"},{\"version\":\"17.3.1a\",\"status\":\"affected\"},{\"version\":\"17.3.1w\",\"status\":\"affected\"},{\"version\":\"17.3.2a\",\"status\":\"affected\"},{\"version\":\"17.3.1x\",\"status\":\"affected\"},{\"version\":\"17.3.1z\",\"status\":\"affected\"},{\"version\":\"17.3.4\",\"status\":\"affected\"},{\"version\":\"17.3.5\",\"status\":\"affected\"},{\"version\":\"17.3.4a\",\"status\":\"affected\"},{\"version\":\"17.3.6\",\"status\":\"affected\"},{\"version\":\"17.3.4b\",\"status\":\"affected\"},{\"version\":\"17.3.4c\",\"status\":\"affected\"},{\"version\":\"17.3.5a\",\"status\":\"affected\"},{\"version\":\"17.3.5b\",\"status\":\"affected\"},{\"version\":\"17.3.7\",\"status\":\"affected\"},{\"version\":\"17.3.8\",\"status\":\"affected\"},{\"version\":\"17.4.1\",\"status\":\"affected\"},{\"version\":\"17.4.2\",\"status\":\"affected\"},{\"version\":\"17.4.1a\",\"status\":\"affected\"},{\"version\":\"17.4.1b\",\"status\":\"affected\"},{\"version\":\"17.4.2a\",\"status\":\"affected\"},{\"version\":\"17.5.1\",\"status\":\"affected\"},{\"version\":\"17.5.1a\",\"status\":\"affected\"},{\"version\":\"17.5.1b\",\"status\":\"affected\"},{\"version\":\"17.5.1c\",\"status\":\"affected\"},{\"version\":\"17.6.1\",\"status\":\"affected\"},{\"version\":\"17.6.2\",\"status\":\"affected\"},{\"version\":\"17.6.1w\",\"status\":\"affected\"},{\"version\":\"17.6.1a\",\"status\":\"affected\"},{\"version\":\"17.6.1x\",\"status\":\"affected\"},{\"version\":\"17.6.3\",\"status\":\"affected\"},{\"version\":\"17.6.1y\",\"status\":\"affected\"},{\"version\":\"17.6.1z\",\"status\":\"affected\"},{\"version\":\"17.6.3a\",\"status\":\"affected\"},{\"version\":\"17.6.4\",\"status\":\"affected\"},{\"version\":\"17.6.1z1\",\"status\":\"affected\"},{\"version\":\"17.6.5\",\"status\":\"affected\"},{\"version\":\"17.6.6\",\"status\":\"affected\"},{\"version\":\"17.7.1\",\"status\":\"affected\"},{\"version\":\"17.7.1a\",\"status\":\"affected\"},{\"version\":\"17.7.1b\",\"status\":\"affected\"},{\"version\":\"17.7.2\",\"status\":\"affected\"},{\"version\":\"17.10.1\",\"status\":\"affected\"},{\"version\":\"17.10.1a\",\"status\":\"affected\"},{\"version\":\"17.10.1b\",\"status\":\"affected\"},{\"version\":\"17.8.1\",\"status\":\"affected\"},{\"version\":\"17.8.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1\",\"status\":\"affected\"},{\"version\":\"17.9.1w\",\"status\":\"affected\"},{\"version\":\"17.9.2\",\"status\":\"affected\"},{\"version\":\"17.9.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1x\",\"status\":\"affected\"},{\"version\":\"17.9.1y\",\"status\":\"affected\"},{\"version\":\"17.9.3\",\"status\":\"affected\"},{\"version\":\"17.9.2a\",\"status\":\"affected\"},{\"version\":\"17.9.1x1\",\"status\":\"affected\"},{\"version\":\"17.9.3a\",\"status\":\"affected\"},{\"version\":\"17.9.4\",\"status\":\"affected\"},{\"version\":\"17.9.1y1\",\"status\":\"affected\"},{\"version\":\"17.11.1\",\"status\":\"affected\"},{\"version\":\"17.11.1a\",\"status\":\"affected\"},{\"version\":\"17.12.1\",\"status\":\"affected\"},{\"version\":\"17.12.1a\",\"status\":\"affected\"},{\"version\":\"17.11.99SW\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-20273\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-20273（Cisco IOS XE Software）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者は認証されたリモートユーザーである必要があります。\n・攻撃者は Web UI に細工した入力を送信できる必要があります。\n・公式の対象表：Cisco / Cisco IOS XE Software。影響ありとして記載：16.1.1。影響ありとして記載：16.1.2。影響ありとして記載：16.1.3。影響ありとして記載：16.2.1。影響ありとして記載：16.2.2。影響ありとして記載：16.3.1。影響ありとして記載：16.3.2。影響ありとして記載：16.3.3。影響ありとして記載：16.3.1a。影響ありとして記載：16.3.4。影響ありとして記載：16.3.5。影響ありとして記載：16.3.5b。影響ありとして記載：16.3.6。影響ありとして記載：16.3.7。影響ありとして記載：16.3.8。影響ありとして記載：16.3.9。影響ありとして記載：16.3.10。影響ありとして記載：16.3.11。影響ありとして記載：16.4.1。影響ありとして記載：16.4.2。影響ありとして記載：16.4.3。影響ありとして記載：16.5.1。影響ありとして記載：16.5.1a。影響ありとして記載：16.5.1b。影響ありとして記載：16.5.2。影響ありとして記載：16.5.3。影響ありとして記載：16.6.1。影響ありとして記載：16.6.2。影響ありとして記載：16.6.3。影響ありとして記載：16.6.4。影響ありとして記載：16.6.5。影響ありとして記載：16.6.4a。影響ありとして記載：16.6.5a。影響ありとして記載：16.6.6。影響ありとして記載：16.6.7。影響ありとして記載：16.6.8。影響ありとして記載：16.6.9。影響ありとして記載：16.6.10。影響ありとして記載：16.7.1。影響ありとして記載：16.7.1a。影響ありとして記載：16.7.1b。影響ありとして記載：16.7.2。影響ありとして記載：16.7.3。影響ありとして記載：16.7.4。影響ありとして記載：16.8.1。影響ありとして記載：16.8.1a。影響ありとして記載：16.8.1b。影響ありとして記載：16.8.1s。影響ありとして記載：16.8.1c。影響ありとして記載：16.8.1d。影響ありとして記載：16.8.2。影響ありとして記載：16.8.1e。影響ありとして記載：16.8.3。影響ありとして記載：16.9.1。影響ありとして記載：16.9.2。影響ありとして記載：16.9.1a。影響ありとして記載：16.9.1b。影響ありとして記載：16.9.1s。影響ありとして記載：16.9.3。影響ありとして記載：16.9.4。影響ありとして記載：16.9.3a。影響ありとして記載：16.9.5。影響ありとして記載：16.9.5f。影響ありとして記載：16.9.6。影響ありとして記載：16.9.7。影響ありとして記載：16.9.8。影響ありとして記載：16.10.1。影響ありとして記載：16.10.1a。影響ありとして記載：16.10.1b。影響ありとして記載：16.10.1s。影響ありとして記載：16.10.1c。影響ありとして記載：16.10.1e。影響ありとして記載：16.10.1d。影響ありとして記載：16.10.2。影響ありとして記載：16.10.1f。影響ありとして記載：16.10.1g。影響ありとして記載：16.10.3。影響ありとして記載：16.11.1。影響ありとして記載：16.11.1a。影響ありとして記載：16.11.1b。影響ありとして記載：16.11.2。影響ありとして記載：16.11.1s。影響ありとして記載：16.12.1。影響ありとして記載：16.12.1s。影響ありとして記載：16.12.1a。影響ありとして記載：16.12.1c。影響ありとして記載：16.12.1w。影響ありとして記載：16.12.2。影響ありとして記載：16.12.1y。影響ありとして記載：16.12.2a。影響ありとして記載：16.12.3。影響ありとして記載：16.12.8。影響ありとして記載：16.12.2s。影響ありとして記載：16.12.1x。影響ありとして記載：16.12.1t。影響ありとして記載：16.12.4。影響ありとして記載：16.12.3s。影響ありとして記載：16.12.3a。影響ありとして記載：16.12.4a。影響ありとして記載：16.12.5。影響ありとして記載：16.12.6。影響ありとして記載：16.12.1z1。影響ありとして記載：16.12.5a。影響ありとして記載：16.12.5b。影響ありとして記載：16.12.1z2。影響ありとして記載：16.12.6a。影響ありとして記載：16.12.7。影響ありとして記載：16.12.9。影響ありとして記載：16.12.10。影響ありとして記載：17.1.1。影響ありとして記載：17.1.1a。影響ありとして記載：17.1.1s。影響ありとして記載：17.1.1t。影響ありとして記載：17.1.3。影響ありとして記載：17.2.1。影響ありとして記載：17.2.1r。影響ありとして記載：17.2.1a。影響ありとして記載：17.2.1v。影響ありとして記載：17.2.2。影響ありとして記載：17.2.3。影響ありとして記載：17.3.1。影響ありとして記載：17.3.2。影響ありとして記載：17.3.3。影響ありとして記載：17.3.1a。影響ありとして記載：17.3.1w。影響ありとして記載：17.3.2a。影響ありとして記載：17.3.1x。影響ありとして記載：17.3.1z。影響ありとして記載：17.3.4。影響ありとして記載：17.3.5。影響ありとして記載：17.3.4a。影響ありとして記載：17.3.6。影響ありとして記載：17.3.4b。影響ありとして記載：17.3.4c。影響ありとして記載：17.3.5a。影響ありとして記載：17.3.5b。影響ありとして記載：17.3.7。影響ありとして記載：17.3.8。影響ありとして記載：17.4.1。影響ありとして記載：17.4.2。影響ありとして記載：17.4.1a。影響ありとして記載：17.4.1b。影響ありとして記載：17.4.2a。影響ありとして記載：17.5.1。影響ありとして記載：17.5.1a。影響ありとして記載：17.5.1b。影響ありとして記載：17.5.1c。影響ありとして記載：17.6.1。影響ありとして記載：17.6.2。影響ありとして記載：17.6.1w。影響ありとして記載：17.6.1a。影響ありとして記載：17.6.1x。影響ありとして記載：17.6.3。影響ありとして記載：17.6.1y。影響ありとして記載：17.6.1z。影響ありとして記載：17.6.3a。影響ありとして記載：17.6.4。影響ありとして記載：17.6.1z1。影響ありとして記載：17.6.5。影響ありとして記載：17.6.6。影響ありとして記載：17.7.1。影響ありとして記載：17.7.1a。影響ありとして記載：17.7.1b。影響ありとして記載：17.7.2。影響ありとして記載：17.10.1。影響ありとして記載：17.10.1a。影響ありとして記載：17.10.1b。影響ありとして記載：17.8.1。影響ありとして記載：17.8.1a。影響ありとして記載：17.9.1。影響ありとして記載：17.9.1w。影響ありとして記載：17.9.2。影響ありとして記載：17.9.1a。影響ありとして記載：17.9.1x。影響ありとして記載：17.9.1y。影響ありとして記載：17.9.3。影響ありとして記載：17.9.2a。影響ありとして記載：17.9.1x1。影響ありとして記載：17.9.3a。影響ありとして記載：17.9.4。影響ありとして記載：17.9.1y1。影響ありとして記載：17.11.1。影響ありとして記載：17.11.1a。影響ありとして記載：17.12.1。影響ありとして記載：17.12.1a。影響ありとして記載：17.11.99SW。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-20273", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:26:29.530Z", "lastSuccess": "2026-10-24T05:26:29.530Z", "sourceCheckedAt": "2026-10-24T05:26:29.530Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-4966", "aliases": [], "title": "NetScaler ADC / NetScaler Gateway：情報の漏えい", "summary": "NetScaler ADC と NetScaler Gateway がゲートウェイ（VPN 仮想サーバー、ICA プロキシ、CVPN、RDP プロキシ）または AAA 仮想サーバーとして構成されている場合に、機密情報が漏洩する脆弱性です。", "risk": "機密情報が外部に漏洩する可能性があります。", "product": "NetScaler ADC / NetScaler Gateway", "category": "other", "component": "package", "severity": "critical", "cvss": 9.4, "cvssVersion": "3.1", "cvssSource": "Citrix", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "affected": [ { "product": "NetScaler ADC", "range": ">= 14.1 / < 8.50" }, { "product": "NetScaler ADC", "range": ">= 13.1 / < 49.15" }, { "product": "NetScaler ADC", "range": ">= 13.0 / < 92.19" }, { "product": "NetScaler ADC", "range": ">= 13.1-FIPS / < 37.164" }, { "product": "NetScaler ADC", "range": ">= 12.1-FIPS / < 55.300" }, { "product": "NetScaler ADC", "range": ">= 12.1-NDcPP / < 55.300" }, { "product": "NetScaler Gateway", "range": ">= 14.1 / < 8.50" }, { "product": "NetScaler Gateway", "range": ">= 13.1 / < 49.15" }, { "product": "NetScaler Gateway", "range": ">= 13.0 / < 92.19" } ], "fixed": [], "steps": [ "ベンダーの指示に従って緩和策を適用し、すべてのアクティブおよび永続的なセッションを終了してください。緩和策が利用できない場合は製品の使用を中止します。", "「CVE-2023-4966」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "label": "CVE：Citrix" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-4966", "label": "CVE公式レコード" }, { "url": "https://support.citrix.com/article/CTX579459", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/", "label": "CISAが示す関連情報" }, { "url": "https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4966", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-10-10T13:12:17.644Z", "modifiedAt": "2026-07-31T03:55:28.627Z", "fetchedAt": "2026-10-24T08:36:32.457Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.", "sourceTitle": "Unauthenticated sensitive information disclosure", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "NetScaler ADC", "vendor": "Citrix", "versions": [ { "lessThan": "8.50", "status": "affected", "version": "14.1", "versionType": "patch" }, { "lessThan": "49.15", "status": "affected", "version": "13.1", "versionType": "patch" }, { "lessThan": "92.19", "status": "affected", "version": "13.0", "versionType": "patch" }, { "lessThan": "37.164", "status": "affected", "version": "13.1-FIPS", "versionType": "patch" }, { "lessThan": "55.300", "status": "affected", "version": "12.1-FIPS", "versionType": "patch" }, { "lessThan": "55.300", "status": "affected", "version": "12.1-NDcPP", "versionType": "patch" } ] }, { "defaultStatus": "unaffected", "product": "NetScaler Gateway", "vendor": "Citrix", "versions": [ { "lessThan": "8.50", "status": "affected", "version": "14.1", "versionType": "patch" }, { "lessThan": "49.15", "status": "affected", "version": "13.1", "versionType": "patch" }, { "lessThan": "92.19", "status": "affected", "version": "13.0", "versionType": "patch" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-4966", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "fetchedAt": "2026-10-24T08:36:32.457Z", "publishedAt": "2023-10-10T13:12:17.644Z", "modifiedAt": "2026-07-31T03:55:28.627Z", "state": "published", "provider": "Citrix", "title": "Unauthenticated sensitive information disclosure", "descriptions": [ { "lang": "en", "value": "Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Citrix", "product": "NetScaler ADC", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "14.1", "lessThan": "8.50", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "13.1", "lessThan": "49.15", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "13.0", "lessThan": "92.19", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "13.1-FIPS", "lessThan": "37.164", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "12.1-FIPS", "lessThan": "55.300", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "12.1-NDcPP", "lessThan": "55.300", "versionType": "patch", "status": "affected" } ] }, { "vendor": "Citrix", "product": "NetScaler Gateway", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "14.1", "lessThan": "8.50", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "13.1", "lessThan": "49.15", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "13.0", "lessThan": "92.19", "versionType": "patch", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-119", "lang": "en", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "baseScore": 9.4, "baseSeverity": "CRITICAL", "provider": "Citrix", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.citrix.com/article/CTX579459", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"NetScaler ADC\",\"vendor\":\"Citrix\",\"versions\":[{\"lessThan\":\"8.50\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"49.15\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"},{\"lessThan\":\"92.19\",\"status\":\"affected\",\"version\":\"13.0\",\"versionType\":\"patch\"},{\"lessThan\":\"37.164\",\"status\":\"affected\",\"version\":\"13.1-FIPS\",\"versionType\":\"patch\"},{\"lessThan\":\"55.300\",\"status\":\"affected\",\"version\":\"12.1-FIPS\",\"versionType\":\"patch\"},{\"lessThan\":\"55.300\",\"status\":\"affected\",\"version\":\"12.1-NDcPP\",\"versionType\":\"patch\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"NetScaler Gateway\",\"vendor\":\"Citrix\",\"versions\":[{\"lessThan\":\"8.50\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"49.15\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"},{\"lessThan\":\"92.19\",\"status\":\"affected\",\"version\":\"13.0\",\"versionType\":\"patch\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-119\",\"description\":\"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"LOW\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-4966:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "sourcePath": "retained:/originalText", "text": "Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-4966:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "modifiedAt": "2023-10-18T00:00:00.000Z", "fetchedAt": "2026-10-24T08:17:50.152Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-31T03:55:28.627Z", "fetchedAt": "2026-10-24T08:36:32.457Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-10-18T00:00:00.000Z", "fetchedAt": "2026-10-24T08:17:50.152Z", "state": "published" } ], "sourceAction": "Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.", "sourceSummary": "NetScaler ADC / NetScaler Gatewayに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T08:36:32.457Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "4a1c177b7a030e23ba00b43d6c3ab80b33c19bd006d57c7df684b43b0fb00726", "sourceModifiedAt": "2026-07-31T03:55:28.627Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "NetScaler ADC と NetScaler Gateway がゲートウェイ（VPN 仮想サーバー、ICA プロキシ、CVPN、RDP プロキシ）または AAA 仮想サーバーとして構成されている場合に、機密情報が漏洩する脆弱性です。", "risk": "機密情報が外部に漏洩する可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は、NetScaler ADC または NetScaler Gateway がゲートウェイ（VPN 仮想サーバー、ICA プロキシ、CVPN、RDP プロキシ）または AAA 仮想サーバーとして設定されている場合です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "S5 と S6 のバージョン範囲記述は、開始バージョンが上限未満となっており矛盾しています（例：14.1 以上 8.50 未満）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json" ], "evidenceIds": [ "E3", "E4", "E2" ] }, { "text": "公式の対象表：Citrix / NetScaler ADC。影響ありとして記載：14.1以上、8.50未満。影響ありとして記載：13.1以上、49.15未満。影響ありとして記載：13.0以上、92.19未満。影響ありとして記載：13.1-FIPS以上、37.164未満。影響ありとして記載：12.1-FIPS以上、55.300未満。影響ありとして記載：12.1-NDcPP以上、55.300未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Citrix / NetScaler Gateway。影響ありとして記載：14.1以上、8.50未満。影響ありとして記載：13.1以上、49.15未満。影響ありとして記載：13.0以上、92.19未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json" ], "evidenceIds": [ "E3" ] }, { "text": "「NetScaler ADC / NetScaler Gateway」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-4966", "https://support.citrix.com/article/CTX579459", "http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/", "https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967", "https://nvd.nist.gov/vuln/detail/CVE-2023-4966" ] } ], "actions": [ { "text": "ベンダーの指示に従って緩和策を適用し、すべてのアクティブおよび永続的なセッションを終了してください。緩和策が利用できない場合は製品の使用を中止します。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966" ], "evidenceIds": [ "E5" ] }, { "text": "「CVE-2023-4966」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-4966", "https://support.citrix.com/article/CTX579459", "http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/", "https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967", "https://nvd.nist.gov/vuln/detail/CVE-2023-4966" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-4966", "https://support.citrix.com/article/CTX579459", "http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/", "https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967", "https://nvd.nist.gov/vuln/detail/CVE-2023-4966" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-4966", "https://support.citrix.com/article/CTX579459", "http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/", "https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967", "https://nvd.nist.gov/vuln/detail/CVE-2023-4966" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-4966", "https://support.citrix.com/article/CTX579459", "http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/", "https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967", "https://nvd.nist.gov/vuln/detail/CVE-2023-4966" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "label": "CVE：Citrix" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-4966", "label": "CVE公式レコード" }, { "url": "https://support.citrix.com/article/CTX579459", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/", "label": "CISAが示す関連情報" }, { "url": "https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4966", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "sourceField": "/containers/cna/title", "excerpt": "Unauthenticated sensitive information disclosure", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"NetScaler ADC\",\"vendor\":\"Citrix\",\"versions\":[{\"lessThan\":\"8.50\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"49.15\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"},{\"lessThan\":\"92.19\",\"status\":\"affected\",\"version\":\"13.0\",\"versionType\":\"patch\"},{\"lessThan\":\"37.164\",\"status\":\"affected\",\"version\":\"13.1-FIPS\",\"versionType\":\"patch\"},{\"lessThan\":\"55.300\",\"status\":\"affected\",\"version\":\"12.1-FIPS\",\"versionType\":\"patch\"},{\"lessThan\":\"55.300\",\"status\":\"affected\",\"version\":\"12.1-NDcPP\",\"versionType\":\"patch\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4966.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"NetScaler Gateway\",\"vendor\":\"Citrix\",\"versions\":[{\"lessThan\":\"8.50\",\"status\":\"affected\",\"version\":\"14.1\",\"versionType\":\"patch\"},{\"lessThan\":\"49.15\",\"status\":\"affected\",\"version\":\"13.1\",\"versionType\":\"patch\"},{\"lessThan\":\"92.19\",\"status\":\"affected\",\"version\":\"13.0\",\"versionType\":\"patch\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-4966\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-4966（NetScaler ADC / NetScaler Gateway）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は、NetScaler ADC または NetScaler Gateway がゲートウェイ（VPN 仮想サーバー、ICA プロキシ、CVPN、RDP プロキシ）または AAA 仮想サーバーとして設定されている場合です。\n・S5 と S6 のバージョン範囲記述は、開始バージョンが上限未満となっており矛盾しています（例：14.1 以上 8.50 未満）。\n・公式の対象表：Citrix / NetScaler ADC。影響ありとして記載：14.1以上、8.50未満。影響ありとして記載：13.1以上、49.15未満。影響ありとして記載：13.0以上、92.19未満。影響ありとして記載：13.1-FIPS以上、37.164未満。影響ありとして記載：12.1-FIPS以上、55.300未満。影響ありとして記載：12.1-NDcPP以上、55.300未満。\n・公式の対象表：Citrix / NetScaler Gateway。影響ありとして記載：14.1以上、8.50未満。影響ありとして記載：13.1以上、49.15未満。影響ありとして記載：13.0以上、92.19未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-4966", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T08:36:32.457Z", "lastSuccess": "2026-10-24T08:36:32.457Z", "sourceCheckedAt": "2026-10-24T08:36:32.457Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-20198", "aliases": [], "title": "Cisco IOS XE Software：脆弱性情報", "summary": "Cisco IOS XE Software の Web UI 機能に対し、攻撃者はまず CVE‑2023‑20198 を利用して初期アクセスを取得し、特権レベル 15 のローカルユーザーとパスワードを作成します。その後、同じ Web UI の別のコンポーネント（CVE‑2023‑20173）を利用して作成したローカルユーザーで特権を root に昇格させ、ファイルシステムにインプラントを書き込むことが確認されています。", "risk": "リモートの認証されていない攻撃者が特権レベル 15 のアカウントを作成し、そのアカウントを使ってデバイスを制御できる可能性があります。", "product": "Cisco IOS XE Software", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Cisco IOS XE Software", "range": "16.1.1" }, { "product": "Cisco IOS XE Software", "range": "16.1.2" }, { "product": "Cisco IOS XE Software", "range": "16.1.3" }, { "product": "Cisco IOS XE Software", "range": "16.2.1" }, { "product": "Cisco IOS XE Software", "range": "16.2.2" }, { "product": "Cisco IOS XE Software", "range": "16.3.1" }, { "product": "Cisco IOS XE Software", "range": "16.3.2" }, { "product": "Cisco IOS XE Software", "range": "16.3.3" }, { "product": "Cisco IOS XE Software", "range": "16.3.1a" }, { "product": "Cisco IOS XE Software", "range": "16.3.4" }, { "product": "Cisco IOS XE Software", "range": "16.3.5" }, { "product": "Cisco IOS XE Software", "range": "16.3.5b" }, { "product": "Cisco IOS XE Software", "range": "16.3.6" }, { "product": "Cisco IOS XE Software", "range": "16.3.7" }, { "product": "Cisco IOS XE Software", "range": "16.3.8" }, { "product": "Cisco IOS XE Software", "range": "16.3.9" }, { "product": "Cisco IOS XE Software", "range": "16.3.10" }, { "product": "Cisco IOS XE Software", "range": "16.3.11" }, { "product": "Cisco IOS XE Software", "range": "16.4.1" }, { "product": "Cisco IOS XE Software", "range": "16.4.2" }, { "product": "Cisco IOS XE Software", "range": "16.4.3" }, { "product": "Cisco IOS XE Software", "range": "16.5.1" }, { "product": "Cisco IOS XE Software", "range": "16.5.1a" }, { "product": "Cisco IOS XE Software", "range": "16.5.1b" }, { "product": "Cisco IOS XE Software", "range": "16.5.2" }, { "product": "Cisco IOS XE Software", "range": "16.5.3" }, { "product": "Cisco IOS XE Software", "range": "16.6.1" }, { "product": "Cisco IOS XE Software", "range": "16.6.2" }, { "product": "Cisco IOS XE Software", "range": "16.6.3" }, { "product": "Cisco IOS XE Software", "range": "16.6.4" }, { "product": "Cisco IOS XE Software", "range": "16.6.5" }, { "product": "Cisco IOS XE Software", "range": "16.6.4a" }, { "product": "Cisco IOS XE Software", "range": "16.6.5a" }, { "product": "Cisco IOS XE Software", "range": "16.6.6" }, { "product": "Cisco IOS XE Software", "range": "16.6.7" }, { "product": "Cisco IOS XE Software", "range": "16.6.8" }, { "product": "Cisco IOS XE Software", "range": "16.6.9" }, { "product": "Cisco IOS XE Software", "range": "16.6.10" }, { "product": "Cisco IOS XE Software", "range": "16.7.1" }, { "product": "Cisco IOS XE Software", "range": "16.7.1a" }, { "product": "Cisco IOS XE Software", "range": "16.7.1b" }, { "product": "Cisco IOS XE Software", "range": "16.7.2" }, { "product": "Cisco IOS XE Software", "range": "16.7.3" }, { "product": "Cisco IOS XE Software", "range": "16.7.4" }, { "product": "Cisco IOS XE Software", "range": "16.8.1" }, { "product": "Cisco IOS XE Software", "range": "16.8.1a" }, { "product": "Cisco IOS XE Software", "range": "16.8.1b" }, { "product": "Cisco IOS XE Software", "range": "16.8.1s" }, { "product": "Cisco IOS XE Software", "range": "16.8.1c" }, { "product": "Cisco IOS XE Software", "range": "16.8.1d" }, { "product": "Cisco IOS XE Software", "range": "16.8.2" }, { "product": "Cisco IOS XE Software", "range": "16.8.1e" }, { "product": "Cisco IOS XE Software", "range": "16.8.3" }, { "product": "Cisco IOS XE Software", "range": "16.9.1" }, { "product": "Cisco IOS XE Software", "range": "16.9.2" }, { "product": "Cisco IOS XE Software", "range": "16.9.1a" }, { "product": "Cisco IOS XE Software", "range": "16.9.1b" }, { "product": "Cisco IOS XE Software", "range": "16.9.1s" }, { "product": "Cisco IOS XE Software", "range": "16.9.3" }, { "product": "Cisco IOS XE Software", "range": "16.9.4" }, { "product": "Cisco IOS XE Software", "range": "16.9.3a" }, { "product": "Cisco IOS XE Software", "range": "16.9.5" }, { "product": "Cisco IOS XE Software", "range": "16.9.5f" }, { "product": "Cisco IOS XE Software", "range": "16.9.6" }, { "product": "Cisco IOS XE Software", "range": "16.9.7" }, { "product": "Cisco IOS XE Software", "range": "16.9.8" }, { "product": "Cisco IOS XE Software", "range": "16.10.1" }, { "product": "Cisco IOS XE Software", "range": "16.10.1a" }, { "product": "Cisco IOS XE Software", "range": "16.10.1b" }, { "product": "Cisco IOS XE Software", "range": "16.10.1s" }, { "product": "Cisco IOS XE Software", "range": "16.10.1c" }, { "product": "Cisco IOS XE Software", "range": "16.10.1e" }, { "product": "Cisco IOS XE Software", "range": "16.10.1d" }, { "product": "Cisco IOS XE Software", "range": "16.10.2" }, { "product": "Cisco IOS XE Software", "range": "16.10.1f" }, { "product": "Cisco IOS XE Software", "range": "16.10.1g" }, { "product": "Cisco IOS XE Software", "range": "16.10.3" }, { "product": "Cisco IOS XE Software", "range": "16.11.1" }, { "product": "Cisco IOS XE Software", "range": "16.11.1a" }, { "product": "Cisco IOS XE Software", "range": "16.11.1b" }, { "product": "Cisco IOS XE Software", "range": "16.11.2" }, { "product": "Cisco IOS XE Software", "range": "16.11.1s" }, { "product": "Cisco IOS XE Software", "range": "16.12.1" }, { "product": "Cisco IOS XE Software", "range": "16.12.1s" }, { "product": "Cisco IOS XE Software", "range": "16.12.1a" }, { "product": "Cisco IOS XE Software", "range": "16.12.1c" }, { "product": "Cisco IOS XE Software", "range": "16.12.1w" }, { "product": "Cisco IOS XE Software", "range": "16.12.2" }, { "product": "Cisco IOS XE Software", "range": "16.12.1y" }, { "product": "Cisco IOS XE Software", "range": "16.12.2a" }, { "product": "Cisco IOS XE Software", "range": "16.12.3" }, { "product": "Cisco IOS XE Software", "range": "16.12.8" }, { "product": "Cisco IOS XE Software", "range": "16.12.2s" }, { "product": "Cisco IOS XE Software", "range": "16.12.1x" }, { "product": "Cisco IOS XE Software", "range": "16.12.1t" }, { "product": "Cisco IOS XE Software", "range": "16.12.4" }, { "product": "Cisco IOS XE Software", "range": "16.12.3s" }, { "product": "Cisco IOS XE Software", "range": "16.12.3a" }, { "product": "Cisco IOS XE Software", "range": "16.12.4a" }, { "product": "Cisco IOS XE Software", "range": "16.12.5" }, { "product": "Cisco IOS XE Software", "range": "16.12.6" }, { "product": "Cisco IOS XE Software", "range": "16.12.1z1" }, { "product": "Cisco IOS XE Software", "range": "16.12.5a" }, { "product": "Cisco IOS XE Software", "range": "16.12.5b" }, { "product": "Cisco IOS XE Software", "range": "16.12.1z2" }, { "product": "Cisco IOS XE Software", "range": "16.12.6a" }, { "product": "Cisco IOS XE Software", "range": "16.12.7" }, { "product": "Cisco IOS XE Software", "range": "16.12.9" }, { "product": "Cisco IOS XE Software", "range": "16.12.10" }, { "product": "Cisco IOS XE Software", "range": "17.1.1" }, { "product": "Cisco IOS XE Software", "range": "17.1.1a" }, { "product": "Cisco IOS XE Software", "range": "17.1.1s" }, { "product": "Cisco IOS XE Software", "range": "17.1.1t" }, { "product": "Cisco IOS XE Software", "range": "17.1.3" }, { "product": "Cisco IOS XE Software", "range": "17.2.1" }, { "product": "Cisco IOS XE Software", "range": "17.2.1r" }, { "product": "Cisco IOS XE Software", "range": "17.2.1a" }, { "product": "Cisco IOS XE Software", "range": "17.2.1v" }, { "product": "Cisco IOS XE Software", "range": "17.2.2" }, { "product": "Cisco IOS XE Software", "range": "17.2.3" }, { "product": "Cisco IOS XE Software", "range": "17.3.1" }, { "product": "Cisco IOS XE Software", "range": "17.3.2" }, { "product": "Cisco IOS XE Software", "range": "17.3.3" }, { "product": "Cisco IOS XE Software", "range": "17.3.1a" }, { "product": "Cisco IOS XE Software", "range": "17.3.1w" }, { "product": "Cisco IOS XE Software", "range": "17.3.2a" }, { "product": "Cisco IOS XE Software", "range": "17.3.1x" }, { "product": "Cisco IOS XE Software", "range": "17.3.1z" }, { "product": "Cisco IOS XE Software", "range": "17.3.4" }, { "product": "Cisco IOS XE Software", "range": "17.3.5" }, { "product": "Cisco IOS XE Software", "range": "17.3.4a" }, { "product": "Cisco IOS XE Software", "range": "17.3.6" }, { "product": "Cisco IOS XE Software", "range": "17.3.4b" }, { "product": "Cisco IOS XE Software", "range": "17.3.4c" }, { "product": "Cisco IOS XE Software", "range": "17.3.5a" }, { "product": "Cisco IOS XE Software", "range": "17.3.5b" }, { "product": "Cisco IOS XE Software", "range": "17.3.7" }, { "product": "Cisco IOS XE Software", "range": "17.3.8" }, { "product": "Cisco IOS XE Software", "range": "17.4.1" }, { "product": "Cisco IOS XE Software", "range": "17.4.2" }, { "product": "Cisco IOS XE Software", "range": "17.4.1a" }, { "product": "Cisco IOS XE Software", "range": "17.4.1b" }, { "product": "Cisco IOS XE Software", "range": "17.4.2a" }, { "product": "Cisco IOS XE Software", "range": "17.5.1" }, { "product": "Cisco IOS XE Software", "range": "17.5.1a" }, { "product": "Cisco IOS XE Software", "range": "17.5.1b" }, { "product": "Cisco IOS XE Software", "range": "17.5.1c" }, { "product": "Cisco IOS XE Software", "range": "17.6.1" }, { "product": "Cisco IOS XE Software", "range": "17.6.2" }, { "product": "Cisco IOS XE Software", "range": "17.6.1w" }, { "product": "Cisco IOS XE Software", "range": "17.6.1a" }, { "product": "Cisco IOS XE Software", "range": "17.6.1x" }, { "product": "Cisco IOS XE Software", "range": "17.6.3" }, { "product": "Cisco IOS XE Software", "range": "17.6.1y" }, { "product": "Cisco IOS XE Software", "range": "17.6.1z" }, { "product": "Cisco IOS XE Software", "range": "17.6.3a" }, { "product": "Cisco IOS XE Software", "range": "17.6.4" }, { "product": "Cisco IOS XE Software", "range": "17.6.1z1" }, { "product": "Cisco IOS XE Software", "range": "17.6.5" }, { "product": "Cisco IOS XE Software", "range": "17.6.6" }, { "product": "Cisco IOS XE Software", "range": "17.7.1" }, { "product": "Cisco IOS XE Software", "range": "17.7.1a" }, { "product": "Cisco IOS XE Software", "range": "17.7.1b" }, { "product": "Cisco IOS XE Software", "range": "17.7.2" }, { "product": "Cisco IOS XE Software", "range": "17.10.1" }, { "product": "Cisco IOS XE Software", "range": "17.10.1a" }, { "product": "Cisco IOS XE Software", "range": "17.10.1b" }, { "product": "Cisco IOS XE Software", "range": "17.8.1" }, { "product": "Cisco IOS XE Software", "range": "17.8.1a" }, { "product": "Cisco IOS XE Software", "range": "17.9.1" }, { "product": "Cisco IOS XE Software", "range": "17.9.1w" }, { "product": "Cisco IOS XE Software", "range": "17.9.2" }, { "product": "Cisco IOS XE Software", "range": "17.9.1a" }, { "product": "Cisco IOS XE Software", "range": "17.9.1x" }, { "product": "Cisco IOS XE Software", "range": "17.9.1y" }, { "product": "Cisco IOS XE Software", "range": "17.9.3" }, { "product": "Cisco IOS XE Software", "range": "17.9.2a" }, { "product": "Cisco IOS XE Software", "range": "17.9.1x1" }, { "product": "Cisco IOS XE Software", "range": "17.9.3a" }, { "product": "Cisco IOS XE Software", "range": "17.9.4" }, { "product": "Cisco IOS XE Software", "range": "17.9.1y1" }, { "product": "Cisco IOS XE Software", "range": "17.11.1" }, { "product": "Cisco IOS XE Software", "range": "17.11.1a" }, { "product": "Cisco IOS XE Software", "range": "17.12.1" }, { "product": "Cisco IOS XE Software", "range": "17.12.1a" }, { "product": "Cisco IOS XE Software", "range": "17.11.99SW" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-20198", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "label": "cisco-sa-iosxe-webui-privesc-j22SaA4z" }, { "url": "https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20198", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-10-16T15:12:58.735Z", "modifiedAt": "2025-10-21T23:05:34.401Z", "fetchedAt": "2026-10-24T07:48:34.576Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [ { "version": "16.1.1", "status": "affected" }, { "version": "16.1.2", "status": "affected" }, { "version": "16.1.3", "status": "affected" }, { "version": "16.2.1", "status": "affected" }, { "version": "16.2.2", "status": "affected" }, { "version": "16.3.1", "status": "affected" }, { "version": "16.3.2", "status": "affected" }, { "version": "16.3.3", "status": "affected" }, { "version": "16.3.1a", "status": "affected" }, { "version": "16.3.4", "status": "affected" }, { "version": "16.3.5", "status": "affected" }, { "version": "16.3.5b", "status": "affected" }, { "version": "16.3.6", "status": "affected" }, { "version": "16.3.7", "status": "affected" }, { "version": "16.3.8", "status": "affected" }, { "version": "16.3.9", "status": "affected" }, { "version": "16.3.10", "status": "affected" }, { "version": "16.3.11", "status": "affected" }, { "version": "16.4.1", "status": "affected" }, { "version": "16.4.2", "status": "affected" }, { "version": "16.4.3", "status": "affected" }, { "version": "16.5.1", "status": "affected" }, { "version": "16.5.1a", "status": "affected" }, { "version": "16.5.1b", "status": "affected" }, { "version": "16.5.2", "status": "affected" }, { "version": "16.5.3", "status": "affected" }, { "version": "16.6.1", "status": "affected" }, { "version": "16.6.2", "status": "affected" }, { "version": "16.6.3", "status": "affected" }, { "version": "16.6.4", "status": "affected" }, { "version": "16.6.5", "status": "affected" }, { "version": "16.6.4a", "status": "affected" }, { "version": "16.6.5a", "status": "affected" }, { "version": "16.6.6", "status": "affected" }, { "version": "16.6.7", "status": "affected" }, { "version": "16.6.8", "status": "affected" }, { "version": "16.6.9", "status": "affected" }, { "version": "16.6.10", "status": "affected" }, { "version": "16.7.1", "status": "affected" }, { "version": "16.7.1a", "status": "affected" }, { "version": "16.7.1b", "status": "affected" }, { "version": "16.7.2", "status": "affected" }, { "version": "16.7.3", "status": "affected" }, { "version": "16.7.4", "status": "affected" }, { "version": "16.8.1", "status": "affected" }, { "version": "16.8.1a", "status": "affected" }, { "version": "16.8.1b", "status": "affected" }, { "version": "16.8.1s", "status": "affected" }, { "version": "16.8.1c", "status": "affected" }, { "version": "16.8.1d", "status": "affected" }, { "version": "16.8.2", "status": "affected" }, { "version": "16.8.1e", "status": "affected" }, { "version": "16.8.3", "status": "affected" }, { "version": "16.9.1", "status": "affected" }, { "version": "16.9.2", "status": "affected" }, { "version": "16.9.1a", "status": "affected" }, { "version": "16.9.1b", "status": "affected" }, { "version": "16.9.1s", "status": "affected" }, { "version": "16.9.3", "status": "affected" }, { "version": "16.9.4", "status": "affected" }, { "version": "16.9.3a", "status": "affected" }, { "version": "16.9.5", "status": "affected" }, { "version": "16.9.5f", "status": "affected" }, { "version": "16.9.6", "status": "affected" }, { "version": "16.9.7", "status": "affected" }, { "version": "16.9.8", "status": "affected" }, { "version": "16.10.1", "status": "affected" }, { "version": "16.10.1a", "status": "affected" }, { "version": "16.10.1b", "status": "affected" }, { "version": "16.10.1s", "status": "affected" }, { "version": "16.10.1c", "status": "affected" }, { "version": "16.10.1e", "status": "affected" }, { "version": "16.10.1d", "status": "affected" }, { "version": "16.10.2", "status": "affected" }, { "version": "16.10.1f", "status": "affected" }, { "version": "16.10.1g", "status": "affected" }, { "version": "16.10.3", "status": "affected" }, { "version": "16.11.1", "status": "affected" }, { "version": "16.11.1a", "status": "affected" }, { "version": "16.11.1b", "status": "affected" }, { "version": "16.11.2", "status": "affected" }, { "version": "16.11.1s", "status": "affected" }, { "version": "16.12.1", "status": "affected" }, { "version": "16.12.1s", "status": "affected" }, { "version": "16.12.1a", "status": "affected" }, { "version": "16.12.1c", "status": "affected" }, { "version": "16.12.1w", "status": "affected" }, { "version": "16.12.2", "status": "affected" }, { "version": "16.12.1y", "status": "affected" }, { "version": "16.12.2a", "status": "affected" }, { "version": "16.12.3", "status": "affected" }, { "version": "16.12.8", "status": "affected" }, { "version": "16.12.2s", "status": "affected" }, { "version": "16.12.1x", "status": "affected" }, { "version": "16.12.1t", "status": "affected" }, { "version": "16.12.4", "status": "affected" }, { "version": "16.12.3s", "status": "affected" }, { "version": "16.12.3a", "status": "affected" }, { "version": "16.12.4a", "status": "affected" }, { "version": "16.12.5", "status": "affected" }, { "version": "16.12.6", "status": "affected" }, { "version": "16.12.1z1", "status": "affected" }, { "version": "16.12.5a", "status": "affected" }, { "version": "16.12.5b", "status": "affected" }, { "version": "16.12.1z2", "status": "affected" }, { "version": "16.12.6a", "status": "affected" }, { "version": "16.12.7", "status": "affected" }, { "version": "16.12.9", "status": "affected" }, { "version": "16.12.10", "status": "affected" }, { "version": "17.1.1", "status": "affected" }, { "version": "17.1.1a", "status": "affected" }, { "version": "17.1.1s", "status": "affected" }, { "version": "17.1.1t", "status": "affected" }, { "version": "17.1.3", "status": "affected" }, { "version": "17.2.1", "status": "affected" }, { "version": "17.2.1r", "status": "affected" }, { "version": "17.2.1a", "status": "affected" }, { "version": "17.2.1v", "status": "affected" }, { "version": "17.2.2", "status": "affected" }, { "version": "17.2.3", "status": "affected" }, { "version": "17.3.1", "status": "affected" }, { "version": "17.3.2", "status": "affected" }, { "version": "17.3.3", "status": "affected" }, { "version": "17.3.1a", "status": "affected" }, { "version": "17.3.1w", "status": "affected" }, { "version": "17.3.2a", "status": "affected" }, { "version": "17.3.1x", "status": "affected" }, { "version": "17.3.1z", "status": "affected" }, { "version": "17.3.4", "status": "affected" }, { "version": "17.3.5", "status": "affected" }, { "version": "17.3.4a", "status": "affected" }, { "version": "17.3.6", "status": "affected" }, { "version": "17.3.4b", "status": "affected" }, { "version": "17.3.4c", "status": "affected" }, { "version": "17.3.5a", "status": "affected" }, { "version": "17.3.5b", "status": "affected" }, { "version": "17.3.7", "status": "affected" }, { "version": "17.3.8", "status": "affected" }, { "version": "17.4.1", "status": "affected" }, { "version": "17.4.2", "status": "affected" }, { "version": "17.4.1a", "status": "affected" }, { "version": "17.4.1b", "status": "affected" }, { "version": "17.4.2a", "status": "affected" }, { "version": "17.5.1", "status": "affected" }, { "version": "17.5.1a", "status": "affected" }, { "version": "17.5.1b", "status": "affected" }, { "version": "17.5.1c", "status": "affected" }, { "version": "17.6.1", "status": "affected" }, { "version": "17.6.2", "status": "affected" }, { "version": "17.6.1w", "status": "affected" }, { "version": "17.6.1a", "status": "affected" }, { "version": "17.6.1x", "status": "affected" }, { "version": "17.6.3", "status": "affected" }, { "version": "17.6.1y", "status": "affected" }, { "version": "17.6.1z", "status": "affected" }, { "version": "17.6.3a", "status": "affected" }, { "version": "17.6.4", "status": "affected" }, { "version": "17.6.1z1", "status": "affected" }, { "version": "17.6.5", "status": "affected" }, { "version": "17.6.6", "status": "affected" }, { "version": "17.7.1", "status": "affected" }, { "version": "17.7.1a", "status": "affected" }, { "version": "17.7.1b", "status": "affected" }, { "version": "17.7.2", "status": "affected" }, { "version": "17.10.1", "status": "affected" }, { "version": "17.10.1a", "status": "affected" }, { "version": "17.10.1b", "status": "affected" }, { "version": "17.8.1", "status": "affected" }, { "version": "17.8.1a", "status": "affected" }, { "version": "17.9.1", "status": "affected" }, { "version": "17.9.1w", "status": "affected" }, { "version": "17.9.2", "status": "affected" }, { "version": "17.9.1a", "status": "affected" }, { "version": "17.9.1x", "status": "affected" }, { "version": "17.9.1y", "status": "affected" }, { "version": "17.9.3", "status": "affected" }, { "version": "17.9.2a", "status": "affected" }, { "version": "17.9.1x1", "status": "affected" }, { "version": "17.9.3a", "status": "affected" }, { "version": "17.9.4", "status": "affected" }, { "version": "17.9.1y1", "status": "affected" }, { "version": "17.11.1", "status": "affected" }, { "version": "17.11.1a", "status": "affected" }, { "version": "17.12.1", "status": "affected" }, { "version": "17.12.1a", "status": "affected" }, { "version": "17.11.99SW", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-20198", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json", "fetchedAt": "2026-10-24T07:48:34.576Z", "publishedAt": "2023-10-16T15:12:58.735Z", "modifiedAt": "2025-10-21T23:05:34.401Z", "state": "published", "provider": "cisco", "title": "", "descriptions": [ { "lang": "en", "value": "Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco IOS XE Software", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "16.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "16.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "16.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "16.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "16.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "16.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "16.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "16.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "16.3.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "16.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "16.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "16.3.5b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "16.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "16.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "16.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "16.3.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "16.3.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "16.3.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "16.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "16.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "16.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "16.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "16.5.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "16.5.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "16.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "16.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "16.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "16.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "16.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "16.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "16.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/31", "version": "16.6.4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/32", "version": "16.6.5a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/33", "version": "16.6.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/34", "version": "16.6.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/35", "version": "16.6.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/36", "version": "16.6.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/37", "version": "16.6.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/38", "version": "16.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/39", "version": "16.7.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/40", "version": "16.7.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/41", "version": "16.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/42", "version": "16.7.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/43", "version": "16.7.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/44", "version": "16.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/45", "version": "16.8.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/46", "version": "16.8.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/47", "version": "16.8.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/48", "version": "16.8.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/49", "version": "16.8.1d", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/50", "version": "16.8.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/51", "version": "16.8.1e", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/52", "version": "16.8.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/53", "version": "16.9.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/54", "version": "16.9.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/55", "version": "16.9.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/56", "version": "16.9.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/57", "version": "16.9.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/58", "version": "16.9.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/59", "version": "16.9.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/60", "version": "16.9.3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/61", "version": "16.9.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/62", "version": "16.9.5f", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/63", "version": "16.9.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/64", "version": "16.9.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/65", "version": "16.9.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/66", "version": "16.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/67", "version": "16.10.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/68", "version": "16.10.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/69", "version": "16.10.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/70", "version": "16.10.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/71", "version": "16.10.1e", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/72", "version": "16.10.1d", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/73", "version": "16.10.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/74", "version": "16.10.1f", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/75", "version": "16.10.1g", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/76", "version": "16.10.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/77", "version": "16.11.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/78", "version": "16.11.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/79", "version": "16.11.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/80", "version": "16.11.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/81", "version": "16.11.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/82", "version": "16.12.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/83", "version": "16.12.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/84", "version": "16.12.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/85", "version": "16.12.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/86", "version": "16.12.1w", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/87", "version": "16.12.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/88", "version": "16.12.1y", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/89", "version": "16.12.2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/90", "version": "16.12.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/91", "version": "16.12.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/92", "version": "16.12.2s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/93", "version": "16.12.1x", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/94", "version": "16.12.1t", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/95", "version": "16.12.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/96", "version": "16.12.3s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/97", "version": "16.12.3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/98", "version": "16.12.4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/99", "version": "16.12.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/100", "version": "16.12.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/101", "version": "16.12.1z1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/102", "version": "16.12.5a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/103", "version": "16.12.5b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/104", "version": "16.12.1z2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/105", "version": "16.12.6a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/106", "version": "16.12.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/107", "version": "16.12.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/108", "version": "16.12.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/109", "version": "17.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/110", "version": "17.1.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/111", "version": "17.1.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/112", "version": "17.1.1t", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/113", "version": "17.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/114", "version": "17.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/115", "version": "17.2.1r", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/116", "version": "17.2.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/117", "version": "17.2.1v", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/118", "version": "17.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/119", "version": "17.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/120", "version": "17.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/121", "version": "17.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/122", "version": "17.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/123", "version": "17.3.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/124", "version": "17.3.1w", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/125", "version": "17.3.2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/126", "version": "17.3.1x", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/127", "version": "17.3.1z", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/128", "version": "17.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/129", "version": "17.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/130", "version": "17.3.4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/131", "version": "17.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/132", "version": "17.3.4b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/133", "version": "17.3.4c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/134", "version": "17.3.5a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/135", "version": "17.3.5b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/136", "version": "17.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/137", "version": "17.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/138", "version": "17.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/139", "version": "17.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/140", "version": "17.4.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/141", "version": "17.4.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/142", "version": "17.4.2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/143", "version": "17.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/144", "version": "17.5.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/145", "version": "17.5.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/146", "version": "17.5.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/147", "version": "17.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/148", "version": "17.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/149", "version": "17.6.1w", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/150", "version": "17.6.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/151", "version": "17.6.1x", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/152", "version": "17.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/153", "version": "17.6.1y", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/154", "version": "17.6.1z", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/155", "version": "17.6.3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/156", "version": "17.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/157", "version": "17.6.1z1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/158", "version": "17.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/159", "version": "17.6.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/160", "version": "17.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/161", "version": "17.7.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/162", "version": "17.7.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/163", "version": "17.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/164", "version": "17.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/165", "version": "17.10.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/166", "version": "17.10.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/167", "version": "17.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/168", "version": "17.8.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/169", "version": "17.9.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/170", "version": "17.9.1w", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/171", "version": "17.9.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/172", "version": "17.9.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/173", "version": "17.9.1x", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/174", "version": "17.9.1y", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/175", "version": "17.9.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/176", "version": "17.9.2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/177", "version": "17.9.1x1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/178", "version": "17.9.3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/179", "version": "17.9.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/180", "version": "17.9.1y1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/181", "version": "17.11.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/182", "version": "17.11.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/183", "version": "17.12.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/184", "version": "17.12.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/185", "version": "17.11.99SW", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "Cisco is aware of active exploitation of these vulnerabilities.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-420", "lang": "en", "description": "Unprotected Alternate Channel", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "label": "cisco-sa-iosxe-webui-privesc-j22SaA4z", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20198", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco IOS XE Software\",\"versions\":[{\"version\":\"16.1.1\",\"status\":\"affected\"},{\"version\":\"16.1.2\",\"status\":\"affected\"},{\"version\":\"16.1.3\",\"status\":\"affected\"},{\"version\":\"16.2.1\",\"status\":\"affected\"},{\"version\":\"16.2.2\",\"status\":\"affected\"},{\"version\":\"16.3.1\",\"status\":\"affected\"},{\"version\":\"16.3.2\",\"status\":\"affected\"},{\"version\":\"16.3.3\",\"status\":\"affected\"},{\"version\":\"16.3.1a\",\"status\":\"affected\"},{\"version\":\"16.3.4\",\"status\":\"affected\"},{\"version\":\"16.3.5\",\"status\":\"affected\"},{\"version\":\"16.3.5b\",\"status\":\"affected\"},{\"version\":\"16.3.6\",\"status\":\"affected\"},{\"version\":\"16.3.7\",\"status\":\"affected\"},{\"version\":\"16.3.8\",\"status\":\"affected\"},{\"version\":\"16.3.9\",\"status\":\"affected\"},{\"version\":\"16.3.10\",\"status\":\"affected\"},{\"version\":\"16.3.11\",\"status\":\"affected\"},{\"version\":\"16.4.1\",\"status\":\"affected\"},{\"version\":\"16.4.2\",\"status\":\"affected\"},{\"version\":\"16.4.3\",\"status\":\"affected\"},{\"version\":\"16.5.1\",\"status\":\"affected\"},{\"version\":\"16.5.1a\",\"status\":\"affected\"},{\"version\":\"16.5.1b\",\"status\":\"affected\"},{\"version\":\"16.5.2\",\"status\":\"affected\"},{\"version\":\"16.5.3\",\"status\":\"affected\"},{\"version\":\"16.6.1\",\"status\":\"affected\"},{\"version\":\"16.6.2\",\"status\":\"affected\"},{\"version\":\"16.6.3\",\"status\":\"affected\"},{\"version\":\"16.6.4\",\"status\":\"affected\"},{\"version\":\"16.6.5\",\"status\":\"affected\"},{\"version\":\"16.6.4a\",\"status\":\"affected\"},{\"version\":\"16.6.5a\",\"status\":\"affected\"},{\"version\":\"16.6.6\",\"status\":\"affected\"},{\"version\":\"16.6.7\",\"status\":\"affected\"},{\"version\":\"16.6.8\",\"status\":\"affected\"},{\"version\":\"16.6.9\",\"status\":\"affected\"},{\"version\":\"16.6.10\",\"status\":\"affected\"},{\"version\":\"16.7.1\",\"status\":\"affected\"},{\"version\":\"16.7.1a\",\"status\":\"affected\"},{\"version\":\"16.7.1b\",\"status\":\"affected\"},{\"version\":\"16.7.2\",\"status\":\"affected\"},{\"version\":\"16.7.3\",\"status\":\"affected\"},{\"version\":\"16.7.4\",\"status\":\"affected\"},{\"version\":\"16.8.1\",\"status\":\"affected\"},{\"version\":\"16.8.1a\",\"status\":\"affected\"},{\"version\":\"16.8.1b\",\"status\":\"affected\"},{\"version\":\"16.8.1s\",\"status\":\"affected\"},{\"version\":\"16.8.1c\",\"status\":\"affected\"},{\"version\":\"16.8.1d\",\"status\":\"affected\"},{\"version\":\"16.8.2\",\"status\":\"affected\"},{\"version\":\"16.8.1e\",\"status\":\"affected\"},{\"version\":\"16.8.3\",\"status\":\"affected\"},{\"version\":\"16.9.1\",\"status\":\"affected\"},{\"version\":\"16.9.2\",\"status\":\"affected\"},{\"version\":\"16.9.1a\",\"status\":\"affected\"},{\"version\":\"16.9.1b\",\"status\":\"affected\"},{\"version\":\"16.9.1s\",\"status\":\"affected\"},{\"version\":\"16.9.3\",\"status\":\"affected\"},{\"version\":\"16.9.4\",\"status\":\"affected\"},{\"version\":\"16.9.3a\",\"status\":\"affected\"},{\"version\":\"16.9.5\",\"status\":\"affected\"},{\"version\":\"16.9.5f\",\"status\":\"affected\"},{\"version\":\"16.9.6\",\"status\":\"affected\"},{\"version\":\"16.9.7\",\"status\":\"affected\"},{\"version\":\"16.9.8\",\"status\":\"affected\"},{\"version\":\"16.10.1\",\"status\":\"affected\"},{\"version\":\"16.10.1a\",\"status\":\"affected\"},{\"version\":\"16.10.1b\",\"status\":\"affected\"},{\"version\":\"16.10.1s\",\"status\":\"affected\"},{\"version\":\"16.10.1c\",\"status\":\"affected\"},{\"version\":\"16.10.1e\",\"status\":\"affected\"},{\"version\":\"16.10.1d\",\"status\":\"affected\"},{\"version\":\"16.10.2\",\"status\":\"affected\"},{\"version\":\"16.10.1f\",\"status\":\"affected\"},{\"version\":\"16.10.1g\",\"status\":\"affected\"},{\"version\":\"16.10.3\",\"status\":\"affected\"},{\"version\":\"16.11.1\",\"status\":\"affected\"},{\"version\":\"16.11.1a\",\"status\":\"affected\"},{\"version\":\"16.11.1b\",\"status\":\"affected\"},{\"version\":\"16.11.2\",\"status\":\"affected\"},{\"version\":\"16.11.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1\",\"status\":\"affected\"},{\"version\":\"16.12.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1a\",\"status\":\"affected\"},{\"version\":\"16.12.1c\",\"status\":\"affected\"},{\"version\":\"16.12.1w\",\"status\":\"affected\"},{\"version\":\"16.12.2\",\"status\":\"affected\"},{\"version\":\"16.12.1y\",\"status\":\"affected\"},{\"version\":\"16.12.2a\",\"status\":\"affected\"},{\"version\":\"16.12.3\",\"status\":\"affected\"},{\"version\":\"16.12.8\",\"status\":\"affected\"},{\"version\":\"16.12.2s\",\"status\":\"affected\"},{\"version\":\"16.12.1x\",\"status\":\"affected\"},{\"version\":\"16.12.1t\",\"status\":\"affected\"},{\"version\":\"16.12.4\",\"status\":\"affected\"},{\"version\":\"16.12.3s\",\"status\":\"affected\"},{\"version\":\"16.12.3a\",\"status\":\"affected\"},{\"version\":\"16.12.4a\",\"status\":\"affected\"},{\"version\":\"16.12.5\",\"status\":\"affected\"},{\"version\":\"16.12.6\",\"status\":\"affected\"},{\"version\":\"16.12.1z1\",\"status\":\"affected\"},{\"version\":\"16.12.5a\",\"status\":\"affected\"},{\"version\":\"16.12.5b\",\"status\":\"affected\"},{\"version\":\"16.12.1z2\",\"status\":\"affected\"},{\"version\":\"16.12.6a\",\"status\":\"affected\"},{\"version\":\"16.12.7\",\"status\":\"affected\"},{\"version\":\"16.12.9\",\"status\":\"affected\"},{\"version\":\"16.12.10\",\"status\":\"affected\"},{\"version\":\"17.1.1\",\"status\":\"affected\"},{\"version\":\"17.1.1a\",\"status\":\"affected\"},{\"version\":\"17.1.1s\",\"status\":\"affected\"},{\"version\":\"17.1.1t\",\"status\":\"affected\"},{\"version\":\"17.1.3\",\"status\":\"affected\"},{\"version\":\"17.2.1\",\"status\":\"affected\"},{\"version\":\"17.2.1r\",\"status\":\"affected\"},{\"version\":\"17.2.1a\",\"status\":\"affected\"},{\"version\":\"17.2.1v\",\"status\":\"affected\"},{\"version\":\"17.2.2\",\"status\":\"affected\"},{\"version\":\"17.2.3\",\"status\":\"affected\"},{\"version\":\"17.3.1\",\"status\":\"affected\"},{\"version\":\"17.3.2\",\"status\":\"affected\"},{\"version\":\"17.3.3\",\"status\":\"affected\"},{\"version\":\"17.3.1a\",\"status\":\"affected\"},{\"version\":\"17.3.1w\",\"status\":\"affected\"},{\"version\":\"17.3.2a\",\"status\":\"affected\"},{\"version\":\"17.3.1x\",\"status\":\"affected\"},{\"version\":\"17.3.1z\",\"status\":\"affected\"},{\"version\":\"17.3.4\",\"status\":\"affected\"},{\"version\":\"17.3.5\",\"status\":\"affected\"},{\"version\":\"17.3.4a\",\"status\":\"affected\"},{\"version\":\"17.3.6\",\"status\":\"affected\"},{\"version\":\"17.3.4b\",\"status\":\"affected\"},{\"version\":\"17.3.4c\",\"status\":\"affected\"},{\"version\":\"17.3.5a\",\"status\":\"affected\"},{\"version\":\"17.3.5b\",\"status\":\"affected\"},{\"version\":\"17.3.7\",\"status\":\"affected\"},{\"version\":\"17.3.8\",\"status\":\"affected\"},{\"version\":\"17.4.1\",\"status\":\"affected\"},{\"version\":\"17.4.2\",\"status\":\"affected\"},{\"version\":\"17.4.1a\",\"status\":\"affected\"},{\"version\":\"17.4.1b\",\"status\":\"affected\"},{\"version\":\"17.4.2a\",\"status\":\"affected\"},{\"version\":\"17.5.1\",\"status\":\"affected\"},{\"version\":\"17.5.1a\",\"status\":\"affected\"},{\"version\":\"17.5.1b\",\"status\":\"affected\"},{\"version\":\"17.5.1c\",\"status\":\"affected\"},{\"version\":\"17.6.1\",\"status\":\"affected\"},{\"version\":\"17.6.2\",\"status\":\"affected\"},{\"version\":\"17.6.1w\",\"status\":\"affected\"},{\"version\":\"17.6.1a\",\"status\":\"affected\"},{\"version\":\"17.6.1x\",\"status\":\"affected\"},{\"version\":\"17.6.3\",\"status\":\"affected\"},{\"version\":\"17.6.1y\",\"status\":\"affected\"},{\"version\":\"17.6.1z\",\"status\":\"affected\"},{\"version\":\"17.6.3a\",\"status\":\"affected\"},{\"version\":\"17.6.4\",\"status\":\"affected\"},{\"version\":\"17.6.1z1\",\"status\":\"affected\"},{\"version\":\"17.6.5\",\"status\":\"affected\"},{\"version\":\"17.6.6\",\"status\":\"affected\"},{\"version\":\"17.7.1\",\"status\":\"affected\"},{\"version\":\"17.7.1a\",\"status\":\"affected\"},{\"version\":\"17.7.1b\",\"status\":\"affected\"},{\"version\":\"17.7.2\",\"status\":\"affected\"},{\"version\":\"17.10.1\",\"status\":\"affected\"},{\"version\":\"17.10.1a\",\"status\":\"affected\"},{\"version\":\"17.10.1b\",\"status\":\"affected\"},{\"version\":\"17.8.1\",\"status\":\"affected\"},{\"version\":\"17.8.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1\",\"status\":\"affected\"},{\"version\":\"17.9.1w\",\"status\":\"affected\"},{\"version\":\"17.9.2\",\"status\":\"affected\"},{\"version\":\"17.9.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1x\",\"status\":\"affected\"},{\"version\":\"17.9.1y\",\"status\":\"affected\"},{\"version\":\"17.9.3\",\"status\":\"affected\"},{\"version\":\"17.9.2a\",\"status\":\"affected\"},{\"version\":\"17.9.1x1\",\"status\":\"affected\"},{\"version\":\"17.9.3a\",\"status\":\"affected\"},{\"version\":\"17.9.4\",\"status\":\"affected\"},{\"version\":\"17.9.1y1\",\"status\":\"affected\"},{\"version\":\"17.11.1\",\"status\":\"affected\"},{\"version\":\"17.11.1a\",\"status\":\"affected\"},{\"version\":\"17.12.1\",\"status\":\"affected\"},{\"version\":\"17.12.1a\",\"status\":\"affected\"},{\"version\":\"17.11.99SW\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "Cisco is aware of active exploitation of these vulnerabilities.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Unprotected Alternate Channel\",\"type\":\"cwe\",\"cweId\":\"CWE-420\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-20198:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "sourcePath": "retained:/originalText", "text": "Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-20198:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "sourcePath": "retained:/sourceAction", "text": "Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "modifiedAt": "2023-10-16T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:34.401Z", "fetchedAt": "2026-10-24T07:48:34.576Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-10-16T00:00:00.000Z", "fetchedAt": "2026-10-24T07:17:50.339Z", "state": "published" } ], "sourceAction": "Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.", "sourceSummary": "Cisco IOS XE Softwareに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T07:48:34.576Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "513d329e6d7b6d2f3a5c1313728d04f09a0a1dcf17e804525ca1c0697eab1b62", "sourceModifiedAt": "2025-10-21T23:05:34.401Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco IOS XE Software の Web UI 機能に対し、攻撃者はまず CVE‑2023‑20198 を利用して初期アクセスを取得し、特権レベル 15 のローカルユーザーとパスワードを作成します。その後、同じ Web UI の別のコンポーネント（CVE‑2023‑20173）を利用して作成したローカルユーザーで特権を root に昇格させ、ファイルシステムにインプラントを書き込むことが確認されています。", "risk": "リモートの認証されていない攻撃者が特権レベル 15 のアカウントを作成し、そのアカウントを使ってデバイスを制御できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "攻撃者は認証なしでリモートからアクセスでき、Cisco IOS XE の Web UI 機能が有効であることが前提です。また、特権レベル 15 のコマンドでローカルユーザーとパスワードを作成できる設定が必要です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json" ], "evidenceIds": [ "E1" ] }, { "text": "作成したローカルユーザーを利用して、Web UI の別コンポーネントを介し特権を root に昇格させ、ファイルシステムにインプラントを書き込むことが可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Cisco / Cisco IOS XE Software。影響ありとして記載：16.1.1。影響ありとして記載：16.1.2。影響ありとして記載：16.1.3。影響ありとして記載：16.2.1。影響ありとして記載：16.2.2。影響ありとして記載：16.3.1。影響ありとして記載：16.3.2。影響ありとして記載：16.3.3。影響ありとして記載：16.3.1a。影響ありとして記載：16.3.4。影響ありとして記載：16.3.5。影響ありとして記載：16.3.5b。影響ありとして記載：16.3.6。影響ありとして記載：16.3.7。影響ありとして記載：16.3.8。影響ありとして記載：16.3.9。影響ありとして記載：16.3.10。影響ありとして記載：16.3.11。影響ありとして記載：16.4.1。影響ありとして記載：16.4.2。影響ありとして記載：16.4.3。影響ありとして記載：16.5.1。影響ありとして記載：16.5.1a。影響ありとして記載：16.5.1b。影響ありとして記載：16.5.2。影響ありとして記載：16.5.3。影響ありとして記載：16.6.1。影響ありとして記載：16.6.2。影響ありとして記載：16.6.3。影響ありとして記載：16.6.4。影響ありとして記載：16.6.5。影響ありとして記載：16.6.4a。影響ありとして記載：16.6.5a。影響ありとして記載：16.6.6。影響ありとして記載：16.6.7。影響ありとして記載：16.6.8。影響ありとして記載：16.6.9。影響ありとして記載：16.6.10。影響ありとして記載：16.7.1。影響ありとして記載：16.7.1a。影響ありとして記載：16.7.1b。影響ありとして記載：16.7.2。影響ありとして記載：16.7.3。影響ありとして記載：16.7.4。影響ありとして記載：16.8.1。影響ありとして記載：16.8.1a。影響ありとして記載：16.8.1b。影響ありとして記載：16.8.1s。影響ありとして記載：16.8.1c。影響ありとして記載：16.8.1d。影響ありとして記載：16.8.2。影響ありとして記載：16.8.1e。影響ありとして記載：16.8.3。影響ありとして記載：16.9.1。影響ありとして記載：16.9.2。影響ありとして記載：16.9.1a。影響ありとして記載：16.9.1b。影響ありとして記載：16.9.1s。影響ありとして記載：16.9.3。影響ありとして記載：16.9.4。影響ありとして記載：16.9.3a。影響ありとして記載：16.9.5。影響ありとして記載：16.9.5f。影響ありとして記載：16.9.6。影響ありとして記載：16.9.7。影響ありとして記載：16.9.8。影響ありとして記載：16.10.1。影響ありとして記載：16.10.1a。影響ありとして記載：16.10.1b。影響ありとして記載：16.10.1s。影響ありとして記載：16.10.1c。影響ありとして記載：16.10.1e。影響ありとして記載：16.10.1d。影響ありとして記載：16.10.2。影響ありとして記載：16.10.1f。影響ありとして記載：16.10.1g。影響ありとして記載：16.10.3。影響ありとして記載：16.11.1。影響ありとして記載：16.11.1a。影響ありとして記載：16.11.1b。影響ありとして記載：16.11.2。影響ありとして記載：16.11.1s。影響ありとして記載：16.12.1。影響ありとして記載：16.12.1s。影響ありとして記載：16.12.1a。影響ありとして記載：16.12.1c。影響ありとして記載：16.12.1w。影響ありとして記載：16.12.2。影響ありとして記載：16.12.1y。影響ありとして記載：16.12.2a。影響ありとして記載：16.12.3。影響ありとして記載：16.12.8。影響ありとして記載：16.12.2s。影響ありとして記載：16.12.1x。影響ありとして記載：16.12.1t。影響ありとして記載：16.12.4。影響ありとして記載：16.12.3s。影響ありとして記載：16.12.3a。影響ありとして記載：16.12.4a。影響ありとして記載：16.12.5。影響ありとして記載：16.12.6。影響ありとして記載：16.12.1z1。影響ありとして記載：16.12.5a。影響ありとして記載：16.12.5b。影響ありとして記載：16.12.1z2。影響ありとして記載：16.12.6a。影響ありとして記載：16.12.7。影響ありとして記載：16.12.9。影響ありとして記載：16.12.10。影響ありとして記載：17.1.1。影響ありとして記載：17.1.1a。影響ありとして記載：17.1.1s。影響ありとして記載：17.1.1t。影響ありとして記載：17.1.3。影響ありとして記載：17.2.1。影響ありとして記載：17.2.1r。影響ありとして記載：17.2.1a。影響ありとして記載：17.2.1v。影響ありとして記載：17.2.2。影響ありとして記載：17.2.3。影響ありとして記載：17.3.1。影響ありとして記載：17.3.2。影響ありとして記載：17.3.3。影響ありとして記載：17.3.1a。影響ありとして記載：17.3.1w。影響ありとして記載：17.3.2a。影響ありとして記載：17.3.1x。影響ありとして記載：17.3.1z。影響ありとして記載：17.3.4。影響ありとして記載：17.3.5。影響ありとして記載：17.3.4a。影響ありとして記載：17.3.6。影響ありとして記載：17.3.4b。影響ありとして記載：17.3.4c。影響ありとして記載：17.3.5a。影響ありとして記載：17.3.5b。影響ありとして記載：17.3.7。影響ありとして記載：17.3.8。影響ありとして記載：17.4.1。影響ありとして記載：17.4.2。影響ありとして記載：17.4.1a。影響ありとして記載：17.4.1b。影響ありとして記載：17.4.2a。影響ありとして記載：17.5.1。影響ありとして記載：17.5.1a。影響ありとして記載：17.5.1b。影響ありとして記載：17.5.1c。影響ありとして記載：17.6.1。影響ありとして記載：17.6.2。影響ありとして記載：17.6.1w。影響ありとして記載：17.6.1a。影響ありとして記載：17.6.1x。影響ありとして記載：17.6.3。影響ありとして記載：17.6.1y。影響ありとして記載：17.6.1z。影響ありとして記載：17.6.3a。影響ありとして記載：17.6.4。影響ありとして記載：17.6.1z1。影響ありとして記載：17.6.5。影響ありとして記載：17.6.6。影響ありとして記載：17.7.1。影響ありとして記載：17.7.1a。影響ありとして記載：17.7.1b。影響ありとして記載：17.7.2。影響ありとして記載：17.10.1。影響ありとして記載：17.10.1a。影響ありとして記載：17.10.1b。影響ありとして記載：17.8.1。影響ありとして記載：17.8.1a。影響ありとして記載：17.9.1。影響ありとして記載：17.9.1w。影響ありとして記載：17.9.2。影響ありとして記載：17.9.1a。影響ありとして記載：17.9.1x。影響ありとして記載：17.9.1y。影響ありとして記載：17.9.3。影響ありとして記載：17.9.2a。影響ありとして記載：17.9.1x1。影響ありとして記載：17.9.3a。影響ありとして記載：17.9.4。影響ありとして記載：17.9.1y1。影響ありとして記載：17.11.1。影響ありとして記載：17.11.1a。影響ありとして記載：17.12.1。影響ありとして記載：17.12.1a。影響ありとして記載：17.11.99SW。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco IOS XE Software」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-20198", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-20198" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-20198", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-20198" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-20198", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-20198" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-20198", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "label": "cisco-sa-iosxe-webui-privesc-j22SaA4z" }, { "url": "https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20198", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "sourceField": "retained:/originalText", "excerpt": "Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20198.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco IOS XE Software\",\"versions\":[{\"version\":\"16.1.1\",\"status\":\"affected\"},{\"version\":\"16.1.2\",\"status\":\"affected\"},{\"version\":\"16.1.3\",\"status\":\"affected\"},{\"version\":\"16.2.1\",\"status\":\"affected\"},{\"version\":\"16.2.2\",\"status\":\"affected\"},{\"version\":\"16.3.1\",\"status\":\"affected\"},{\"version\":\"16.3.2\",\"status\":\"affected\"},{\"version\":\"16.3.3\",\"status\":\"affected\"},{\"version\":\"16.3.1a\",\"status\":\"affected\"},{\"version\":\"16.3.4\",\"status\":\"affected\"},{\"version\":\"16.3.5\",\"status\":\"affected\"},{\"version\":\"16.3.5b\",\"status\":\"affected\"},{\"version\":\"16.3.6\",\"status\":\"affected\"},{\"version\":\"16.3.7\",\"status\":\"affected\"},{\"version\":\"16.3.8\",\"status\":\"affected\"},{\"version\":\"16.3.9\",\"status\":\"affected\"},{\"version\":\"16.3.10\",\"status\":\"affected\"},{\"version\":\"16.3.11\",\"status\":\"affected\"},{\"version\":\"16.4.1\",\"status\":\"affected\"},{\"version\":\"16.4.2\",\"status\":\"affected\"},{\"version\":\"16.4.3\",\"status\":\"affected\"},{\"version\":\"16.5.1\",\"status\":\"affected\"},{\"version\":\"16.5.1a\",\"status\":\"affected\"},{\"version\":\"16.5.1b\",\"status\":\"affected\"},{\"version\":\"16.5.2\",\"status\":\"affected\"},{\"version\":\"16.5.3\",\"status\":\"affected\"},{\"version\":\"16.6.1\",\"status\":\"affected\"},{\"version\":\"16.6.2\",\"status\":\"affected\"},{\"version\":\"16.6.3\",\"status\":\"affected\"},{\"version\":\"16.6.4\",\"status\":\"affected\"},{\"version\":\"16.6.5\",\"status\":\"affected\"},{\"version\":\"16.6.4a\",\"status\":\"affected\"},{\"version\":\"16.6.5a\",\"status\":\"affected\"},{\"version\":\"16.6.6\",\"status\":\"affected\"},{\"version\":\"16.6.7\",\"status\":\"affected\"},{\"version\":\"16.6.8\",\"status\":\"affected\"},{\"version\":\"16.6.9\",\"status\":\"affected\"},{\"version\":\"16.6.10\",\"status\":\"affected\"},{\"version\":\"16.7.1\",\"status\":\"affected\"},{\"version\":\"16.7.1a\",\"status\":\"affected\"},{\"version\":\"16.7.1b\",\"status\":\"affected\"},{\"version\":\"16.7.2\",\"status\":\"affected\"},{\"version\":\"16.7.3\",\"status\":\"affected\"},{\"version\":\"16.7.4\",\"status\":\"affected\"},{\"version\":\"16.8.1\",\"status\":\"affected\"},{\"version\":\"16.8.1a\",\"status\":\"affected\"},{\"version\":\"16.8.1b\",\"status\":\"affected\"},{\"version\":\"16.8.1s\",\"status\":\"affected\"},{\"version\":\"16.8.1c\",\"status\":\"affected\"},{\"version\":\"16.8.1d\",\"status\":\"affected\"},{\"version\":\"16.8.2\",\"status\":\"affected\"},{\"version\":\"16.8.1e\",\"status\":\"affected\"},{\"version\":\"16.8.3\",\"status\":\"affected\"},{\"version\":\"16.9.1\",\"status\":\"affected\"},{\"version\":\"16.9.2\",\"status\":\"affected\"},{\"version\":\"16.9.1a\",\"status\":\"affected\"},{\"version\":\"16.9.1b\",\"status\":\"affected\"},{\"version\":\"16.9.1s\",\"status\":\"affected\"},{\"version\":\"16.9.3\",\"status\":\"affected\"},{\"version\":\"16.9.4\",\"status\":\"affected\"},{\"version\":\"16.9.3a\",\"status\":\"affected\"},{\"version\":\"16.9.5\",\"status\":\"affected\"},{\"version\":\"16.9.5f\",\"status\":\"affected\"},{\"version\":\"16.9.6\",\"status\":\"affected\"},{\"version\":\"16.9.7\",\"status\":\"affected\"},{\"version\":\"16.9.8\",\"status\":\"affected\"},{\"version\":\"16.10.1\",\"status\":\"affected\"},{\"version\":\"16.10.1a\",\"status\":\"affected\"},{\"version\":\"16.10.1b\",\"status\":\"affected\"},{\"version\":\"16.10.1s\",\"status\":\"affected\"},{\"version\":\"16.10.1c\",\"status\":\"affected\"},{\"version\":\"16.10.1e\",\"status\":\"affected\"},{\"version\":\"16.10.1d\",\"status\":\"affected\"},{\"version\":\"16.10.2\",\"status\":\"affected\"},{\"version\":\"16.10.1f\",\"status\":\"affected\"},{\"version\":\"16.10.1g\",\"status\":\"affected\"},{\"version\":\"16.10.3\",\"status\":\"affected\"},{\"version\":\"16.11.1\",\"status\":\"affected\"},{\"version\":\"16.11.1a\",\"status\":\"affected\"},{\"version\":\"16.11.1b\",\"status\":\"affected\"},{\"version\":\"16.11.2\",\"status\":\"affected\"},{\"version\":\"16.11.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1\",\"status\":\"affected\"},{\"version\":\"16.12.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1a\",\"status\":\"affected\"},{\"version\":\"16.12.1c\",\"status\":\"affected\"},{\"version\":\"16.12.1w\",\"status\":\"affected\"},{\"version\":\"16.12.2\",\"status\":\"affected\"},{\"version\":\"16.12.1y\",\"status\":\"affected\"},{\"version\":\"16.12.2a\",\"status\":\"affected\"},{\"version\":\"16.12.3\",\"status\":\"affected\"},{\"version\":\"16.12.8\",\"status\":\"affected\"},{\"version\":\"16.12.2s\",\"status\":\"affected\"},{\"version\":\"16.12.1x\",\"status\":\"affected\"},{\"version\":\"16.12.1t\",\"status\":\"affected\"},{\"version\":\"16.12.4\",\"status\":\"affected\"},{\"version\":\"16.12.3s\",\"status\":\"affected\"},{\"version\":\"16.12.3a\",\"status\":\"affected\"},{\"version\":\"16.12.4a\",\"status\":\"affected\"},{\"version\":\"16.12.5\",\"status\":\"affected\"},{\"version\":\"16.12.6\",\"status\":\"affected\"},{\"version\":\"16.12.1z1\",\"status\":\"affected\"},{\"version\":\"16.12.5a\",\"status\":\"affected\"},{\"version\":\"16.12.5b\",\"status\":\"affected\"},{\"version\":\"16.12.1z2\",\"status\":\"affected\"},{\"version\":\"16.12.6a\",\"status\":\"affected\"},{\"version\":\"16.12.7\",\"status\":\"affected\"},{\"version\":\"16.12.9\",\"status\":\"affected\"},{\"version\":\"16.12.10\",\"status\":\"affected\"},{\"version\":\"17.1.1\",\"status\":\"affected\"},{\"version\":\"17.1.1a\",\"status\":\"affected\"},{\"version\":\"17.1.1s\",\"status\":\"affected\"},{\"version\":\"17.1.1t\",\"status\":\"affected\"},{\"version\":\"17.1.3\",\"status\":\"affected\"},{\"version\":\"17.2.1\",\"status\":\"affected\"},{\"version\":\"17.2.1r\",\"status\":\"affected\"},{\"version\":\"17.2.1a\",\"status\":\"affected\"},{\"version\":\"17.2.1v\",\"status\":\"affected\"},{\"version\":\"17.2.2\",\"status\":\"affected\"},{\"version\":\"17.2.3\",\"status\":\"affected\"},{\"version\":\"17.3.1\",\"status\":\"affected\"},{\"version\":\"17.3.2\",\"status\":\"affected\"},{\"version\":\"17.3.3\",\"status\":\"affected\"},{\"version\":\"17.3.1a\",\"status\":\"affected\"},{\"version\":\"17.3.1w\",\"status\":\"affected\"},{\"version\":\"17.3.2a\",\"status\":\"affected\"},{\"version\":\"17.3.1x\",\"status\":\"affected\"},{\"version\":\"17.3.1z\",\"status\":\"affected\"},{\"version\":\"17.3.4\",\"status\":\"affected\"},{\"version\":\"17.3.5\",\"status\":\"affected\"},{\"version\":\"17.3.4a\",\"status\":\"affected\"},{\"version\":\"17.3.6\",\"status\":\"affected\"},{\"version\":\"17.3.4b\",\"status\":\"affected\"},{\"version\":\"17.3.4c\",\"status\":\"affected\"},{\"version\":\"17.3.5a\",\"status\":\"affected\"},{\"version\":\"17.3.5b\",\"status\":\"affected\"},{\"version\":\"17.3.7\",\"status\":\"affected\"},{\"version\":\"17.3.8\",\"status\":\"affected\"},{\"version\":\"17.4.1\",\"status\":\"affected\"},{\"version\":\"17.4.2\",\"status\":\"affected\"},{\"version\":\"17.4.1a\",\"status\":\"affected\"},{\"version\":\"17.4.1b\",\"status\":\"affected\"},{\"version\":\"17.4.2a\",\"status\":\"affected\"},{\"version\":\"17.5.1\",\"status\":\"affected\"},{\"version\":\"17.5.1a\",\"status\":\"affected\"},{\"version\":\"17.5.1b\",\"status\":\"affected\"},{\"version\":\"17.5.1c\",\"status\":\"affected\"},{\"version\":\"17.6.1\",\"status\":\"affected\"},{\"version\":\"17.6.2\",\"status\":\"affected\"},{\"version\":\"17.6.1w\",\"status\":\"affected\"},{\"version\":\"17.6.1a\",\"status\":\"affected\"},{\"version\":\"17.6.1x\",\"status\":\"affected\"},{\"version\":\"17.6.3\",\"status\":\"affected\"},{\"version\":\"17.6.1y\",\"status\":\"affected\"},{\"version\":\"17.6.1z\",\"status\":\"affected\"},{\"version\":\"17.6.3a\",\"status\":\"affected\"},{\"version\":\"17.6.4\",\"status\":\"affected\"},{\"version\":\"17.6.1z1\",\"status\":\"affected\"},{\"version\":\"17.6.5\",\"status\":\"affected\"},{\"version\":\"17.6.6\",\"status\":\"affected\"},{\"version\":\"17.7.1\",\"status\":\"affected\"},{\"version\":\"17.7.1a\",\"status\":\"affected\"},{\"version\":\"17.7.1b\",\"status\":\"affected\"},{\"version\":\"17.7.2\",\"status\":\"affected\"},{\"version\":\"17.10.1\",\"status\":\"affected\"},{\"version\":\"17.10.1a\",\"status\":\"affected\"},{\"version\":\"17.10.1b\",\"status\":\"affected\"},{\"version\":\"17.8.1\",\"status\":\"affected\"},{\"version\":\"17.8.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1\",\"status\":\"affected\"},{\"version\":\"17.9.1w\",\"status\":\"affected\"},{\"version\":\"17.9.2\",\"status\":\"affected\"},{\"version\":\"17.9.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1x\",\"status\":\"affected\"},{\"version\":\"17.9.1y\",\"status\":\"affected\"},{\"version\":\"17.9.3\",\"status\":\"affected\"},{\"version\":\"17.9.2a\",\"status\":\"affected\"},{\"version\":\"17.9.1x1\",\"status\":\"affected\"},{\"version\":\"17.9.3a\",\"status\":\"affected\"},{\"version\":\"17.9.4\",\"status\":\"affected\"},{\"version\":\"17.9.1y1\",\"status\":\"affected\"},{\"version\":\"17.11.1\",\"status\":\"affected\"},{\"version\":\"17.11.1a\",\"status\":\"affected\"},{\"version\":\"17.12.1\",\"status\":\"affected\"},{\"version\":\"17.12.1a\",\"status\":\"affected\"},{\"version\":\"17.11.99SW\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20198", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-20198\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-20198（Cisco IOS XE Software）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者は認証なしでリモートからアクセスでき、Cisco IOS XE の Web UI 機能が有効であることが前提です。また、特権レベル 15 のコマンドでローカルユーザーとパスワードを作成できる設定が必要です。\n・作成したローカルユーザーを利用して、Web UI の別コンポーネントを介し特権を root に昇格させ、ファイルシステムにインプラントを書き込むことが可能です。\n・公式の対象表：Cisco / Cisco IOS XE Software。影響ありとして記載：16.1.1。影響ありとして記載：16.1.2。影響ありとして記載：16.1.3。影響ありとして記載：16.2.1。影響ありとして記載：16.2.2。影響ありとして記載：16.3.1。影響ありとして記載：16.3.2。影響ありとして記載：16.3.3。影響ありとして記載：16.3.1a。影響ありとして記載：16.3.4。影響ありとして記載：16.3.5。影響ありとして記載：16.3.5b。影響ありとして記載：16.3.6。影響ありとして記載：16.3.7。影響ありとして記載：16.3.8。影響ありとして記載：16.3.9。影響ありとして記載：16.3.10。影響ありとして記載：16.3.11。影響ありとして記載：16.4.1。影響ありとして記載：16.4.2。影響ありとして記載：16.4.3。影響ありとして記載：16.5.1。影響ありとして記載：16.5.1a。影響ありとして記載：16.5.1b。影響ありとして記載：16.5.2。影響ありとして記載：16.5.3。影響ありとして記載：16.6.1。影響ありとして記載：16.6.2。影響ありとして記載：16.6.3。影響ありとして記載：16.6.4。影響ありとして記載：16.6.5。影響ありとして記載：16.6.4a。影響ありとして記載：16.6.5a。影響ありとして記載：16.6.6。影響ありとして記載：16.6.7。影響ありとして記載：16.6.8。影響ありとして記載：16.6.9。影響ありとして記載：16.6.10。影響ありとして記載：16.7.1。影響ありとして記載：16.7.1a。影響ありとして記載：16.7.1b。影響ありとして記載：16.7.2。影響ありとして記載：16.7.3。影響ありとして記載：16.7.4。影響ありとして記載：16.8.1。影響ありとして記載：16.8.1a。影響ありとして記載：16.8.1b。影響ありとして記載：16.8.1s。影響ありとして記載：16.8.1c。影響ありとして記載：16.8.1d。影響ありとして記載：16.8.2。影響ありとして記載：16.8.1e。影響ありとして記載：16.8.3。影響ありとして記載：16.9.1。影響ありとして記載：16.9.2。影響ありとして記載：16.9.1a。影響ありとして記載：16.9.1b。影響ありとして記載：16.9.1s。影響ありとして記載：16.9.3。影響ありとして記載：16.9.4。影響ありとして記載：16.9.3a。影響ありとして記載：16.9.5。影響ありとして記載：16.9.5f。影響ありとして記載：16.9.6。影響ありとして記載：16.9.7。影響ありとして記載：16.9.8。影響ありとして記載：16.10.1。影響ありとして記載：16.10.1a。影響ありとして記載：16.10.1b。影響ありとして記載：16.10.1s。影響ありとして記載：16.10.1c。影響ありとして記載：16.10.1e。影響ありとして記載：16.10.1d。影響ありとして記載：16.10.2。影響ありとして記載：16.10.1f。影響ありとして記載：16.10.1g。影響ありとして記載：16.10.3。影響ありとして記載：16.11.1。影響ありとして記載：16.11.1a。影響ありとして記載：16.11.1b。影響ありとして記載：16.11.2。影響ありとして記載：16.11.1s。影響ありとして記載：16.12.1。影響ありとして記載：16.12.1s。影響ありとして記載：16.12.1a。影響ありとして記載：16.12.1c。影響ありとして記載：16.12.1w。影響ありとして記載：16.12.2。影響ありとして記載：16.12.1y。影響ありとして記載：16.12.2a。影響ありとして記載：16.12.3。影響ありとして記載：16.12.8。影響ありとして記載：16.12.2s。影響ありとして記載：16.12.1x。影響ありとして記載：16.12.1t。影響ありとして記載：16.12.4。影響ありとして記載：16.12.3s。影響ありとして記載：16.12.3a。影響ありとして記載：16.12.4a。影響ありとして記載：16.12.5。影響ありとして記載：16.12.6。影響ありとして記載：16.12.1z1。影響ありとして記載：16.12.5a。影響ありとして記載：16.12.5b。影響ありとして記載：16.12.1z2。影響ありとして記載：16.12.6a。影響ありとして記載：16.12.7。影響ありとして記載：16.12.9。影響ありとして記載：16.12.10。影響ありとして記載：17.1.1。影響ありとして記載：17.1.1a。影響ありとして記載：17.1.1s。影響ありとして記載：17.1.1t。影響ありとして記載：17.1.3。影響ありとして記載：17.2.1。影響ありとして記載：17.2.1r。影響ありとして記載：17.2.1a。影響ありとして記載：17.2.1v。影響ありとして記載：17.2.2。影響ありとして記載：17.2.3。影響ありとして記載：17.3.1。影響ありとして記載：17.3.2。影響ありとして記載：17.3.3。影響ありとして記載：17.3.1a。影響ありとして記載：17.3.1w。影響ありとして記載：17.3.2a。影響ありとして記載：17.3.1x。影響ありとして記載：17.3.1z。影響ありとして記載：17.3.4。影響ありとして記載：17.3.5。影響ありとして記載：17.3.4a。影響ありとして記載：17.3.6。影響ありとして記載：17.3.4b。影響ありとして記載：17.3.4c。影響ありとして記載：17.3.5a。影響ありとして記載：17.3.5b。影響ありとして記載：17.3.7。影響ありとして記載：17.3.8。影響ありとして記載：17.4.1。影響ありとして記載：17.4.2。影響ありとして記載：17.4.1a。影響ありとして記載：17.4.1b。影響ありとして記載：17.4.2a。影響ありとして記載：17.5.1。影響ありとして記載：17.5.1a。影響ありとして記載：17.5.1b。影響ありとして記載：17.5.1c。影響ありとして記載：17.6.1。影響ありとして記載：17.6.2。影響ありとして記載：17.6.1w。影響ありとして記載：17.6.1a。影響ありとして記載：17.6.1x。影響ありとして記載：17.6.3。影響ありとして記載：17.6.1y。影響ありとして記載：17.6.1z。影響ありとして記載：17.6.3a。影響ありとして記載：17.6.4。影響ありとして記載：17.6.1z1。影響ありとして記載：17.6.5。影響ありとして記載：17.6.6。影響ありとして記載：17.7.1。影響ありとして記載：17.7.1a。影響ありとして記載：17.7.1b。影響ありとして記載：17.7.2。影響ありとして記載：17.10.1。影響ありとして記載：17.10.1a。影響ありとして記載：17.10.1b。影響ありとして記載：17.8.1。影響ありとして記載：17.8.1a。影響ありとして記載：17.9.1。影響ありとして記載：17.9.1w。影響ありとして記載：17.9.2。影響ありとして記載：17.9.1a。影響ありとして記載：17.9.1x。影響ありとして記載：17.9.1y。影響ありとして記載：17.9.3。影響ありとして記載：17.9.2a。影響ありとして記載：17.9.1x1。影響ありとして記載：17.9.3a。影響ありとして記載：17.9.4。影響ありとして記載：17.9.1y1。影響ありとして記載：17.11.1。影響ありとして記載：17.11.1a。影響ありとして記載：17.12.1。影響ありとして記載：17.12.1a。影響ありとして記載：17.11.99SW。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-20198", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T07:48:34.576Z", "lastSuccess": "2026-10-24T07:48:34.576Z", "sourceCheckedAt": "2026-10-24T07:48:34.576Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-20109", "aliases": [], "title": "IOS / Cisco IOS XE Software：コード実行", "summary": "Cisco IOS および IOS XE の GET VPN 機能において、Group Domain of Interpretation (GDOI) と G‑IKEv2 プロトコルの属性検証が不十分であるため、認証されたリモート攻撃者がグループメンバーまたはキーサーバーの管理権限を取得すると、任意のコードを実行させるか、デバイスをクラッシュさせることができる。", "risk": "攻撃が成功すると、攻撃者はデバイス上で任意のコードを実行でき、システムを完全に制御できるか、リロードさせてサービス停止（DoS）状態になる可能性がある。", "product": "IOS / Cisco IOS XE Software", "category": "other", "component": "package", "severity": "medium", "cvss": 6.6, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "IOS", "range": "12.4(24)T" }, { "product": "IOS", "range": "12.4(24)T3" }, { "product": "IOS", "range": "12.4(22)T1" }, { "product": "IOS", "range": "12.4(24)T5" }, { "product": "IOS", "range": "12.4(24)T4" }, { "product": "IOS", "range": "12.4(22)T" }, { "product": "IOS", "range": "12.4(24)T8" }, { "product": "IOS", "range": "12.4(24)T2" }, { "product": "IOS", "range": "12.4(22)T5" }, { "product": "IOS", "range": "12.4(22)T4" }, { "product": "IOS", "range": "12.4(24)T1" }, { "product": "IOS", "range": "12.4(24)T7" }, { "product": "IOS", "range": "12.4(22)T3" }, { "product": "IOS", "range": "12.4(24)T6" }, { "product": "IOS", "range": "12.4(22)T2" }, { "product": "IOS", "range": "12.4(24)T4a" }, { "product": "IOS", "range": "12.4(24)T4b" }, { "product": "IOS", "range": "12.4(24)T3e" }, { "product": "IOS", "range": "12.4(24)T4c" }, { "product": "IOS", "range": "12.4(24)T4d" }, { "product": "IOS", "range": "12.4(24)T4e" }, { "product": "IOS", "range": "12.4(24)T3f" }, { "product": "IOS", "range": "12.4(24)T4f" }, { "product": "IOS", "range": "12.4(24)T4l" }, { "product": "IOS", "range": "12.4(24)MD1" }, { "product": "IOS", "range": "12.4(24)MD" }, { "product": "IOS", "range": "12.4(24)MD3" }, { "product": "IOS", "range": "12.4(24)MD2" }, { "product": "IOS", "range": "12.4(22)MD1" }, { "product": "IOS", "range": "12.4(22)MD2" }, { "product": "IOS", "range": "12.4(24)MD5" }, { "product": "IOS", "range": "12.4(22)MD" }, { "product": "IOS", "range": "12.4(24)MD4" }, { "product": "IOS", "range": "12.4(24)MD6" }, { "product": "IOS", "range": "12.4(24)MD7" }, { "product": "IOS", "range": "12.4(22)XR5" }, { "product": "IOS", "range": "12.4(22)XR4" }, { "product": "IOS", "range": "12.4(22)XR7" }, { "product": "IOS", "range": "12.4(22)XR2" }, { "product": "IOS", "range": "12.4(22)XR6" }, { "product": "IOS", "range": "12.4(22)XR10" }, { "product": "IOS", "range": "12.4(22)XR1" }, { "product": "IOS", "range": "12.4(22)XR9" }, { "product": "IOS", "range": "12.4(22)XR3" }, { "product": "IOS", "range": "12.4(22)XR8" }, { "product": "IOS", "range": "12.4(22)XR11" }, { "product": "IOS", "range": "12.4(22)XR12" }, { "product": "IOS", "range": "12.4(22)MDA3" }, { "product": "IOS", "range": "12.4(24)MDA5" }, { "product": "IOS", "range": "12.4(22)MDA5" }, { "product": "IOS", "range": "12.4(24)MDA3" }, { "product": "IOS", "range": "12.4(22)MDA4" }, { "product": "IOS", "range": "12.4(24)MDA4" }, { "product": "IOS", "range": "12.4(24)MDA1" }, { "product": "IOS", "range": "12.4(22)MDA" }, { "product": "IOS", "range": "12.4(22)MDA2" }, { "product": "IOS", "range": "12.4(22)MDA1" }, { "product": "IOS", "range": "12.4(24)MDA2" }, { "product": "IOS", "range": "12.4(22)MDA6" }, { "product": "IOS", "range": "12.4(24)MDA6" }, { "product": "IOS", "range": "12.4(24)MDA7" }, { "product": "IOS", "range": "12.4(24)MDA8" }, { "product": "IOS", "range": "12.4(24)MDA10" }, { "product": "IOS", "range": "12.4(24)MDA9" }, { "product": "IOS", "range": "12.4(24)MDA11" }, { "product": "IOS", "range": "12.4(24)MDA12" }, { "product": "IOS", "range": "12.4(24)MDA13" }, { "product": "IOS", "range": "12.4(24)YG3" }, { "product": "IOS", "range": "12.4(24)YG4" }, { "product": "IOS", "range": "12.4(24)YG1" }, { "product": "IOS", "range": "12.4(24)YG2" }, { "product": "IOS", "range": "12.4(24)YG" }, { "product": "IOS", "range": "15.0(1)M1" }, { "product": "IOS", "range": "15.0(1)M5" }, { "product": "IOS", "range": "15.0(1)M4" }, { "product": "IOS", "range": "15.0(1)M3" }, { "product": "IOS", "range": "15.0(1)M2" }, { "product": "IOS", "range": "15.0(1)M6" }, { "product": "IOS", "range": "15.0(1)M" }, { "product": "IOS", "range": "15.0(1)M7" }, { "product": "IOS", "range": "15.0(1)M10" }, { "product": "IOS", "range": "15.0(1)M9" }, { "product": "IOS", "range": "15.0(1)M8" }, { "product": "IOS", "range": "15.0(1)XA2" }, { "product": "IOS", "range": "15.0(1)XA4" }, { "product": "IOS", "range": "15.0(1)XA1" }, { "product": "IOS", "range": "15.0(1)XA3" }, { "product": "IOS", "range": "15.0(1)XA" }, { "product": "IOS", "range": "15.0(1)XA5" }, { "product": "IOS", "range": "15.1(2)T" }, { "product": "IOS", "range": "15.1(1)T4" }, { "product": "IOS", "range": "15.1(3)T2" }, { "product": "IOS", "range": "15.1(1)T1" }, { "product": "IOS", "range": "15.1(2)T0a" }, { "product": "IOS", "range": "15.1(3)T3" }, { "product": "IOS", "range": "15.1(1)T3" }, { "product": "IOS", "range": "15.1(2)T3" }, { "product": "IOS", "range": "15.1(2)T4" }, { "product": "IOS", "range": "15.1(1)T2" }, { "product": "IOS", "range": "15.1(3)T" }, { "product": "IOS", "range": "15.1(2)T2a" }, { "product": "IOS", "range": "15.1(3)T1" }, { "product": "IOS", "range": "15.1(1)T" }, { "product": "IOS", "range": "15.1(2)T2" }, { "product": "IOS", "range": "15.1(2)T1" }, { "product": "IOS", "range": "15.1(2)T5" }, { "product": "IOS", "range": "15.1(3)T4" }, { "product": "IOS", "range": "15.1(1)T5" }, { "product": "IOS", "range": "15.1(1)XB" }, { "product": "IOS", "range": "15.0(1)S2" }, { "product": "IOS", "range": "15.0(1)S1" }, { "product": "IOS", "range": "15.0(1)S" }, { "product": "IOS", "range": "15.0(1)S3a" }, { "product": "IOS", "range": "15.0(1)S4" }, { "product": "IOS", "range": "15.0(1)S5" }, { "product": "IOS", "range": "15.0(1)S4a" }, { "product": "IOS", "range": "15.0(1)S6" }, { "product": "IOS", "range": "15.2(1)S" }, { "product": "IOS", "range": "15.2(2)S" }, { "product": "IOS", "range": "15.2(1)S1" }, { "product": "IOS", "range": "15.2(4)S" }, { "product": "IOS", "range": "15.2(1)S2" }, { "product": "IOS", "range": "15.2(2)S1" }, { "product": "IOS", "range": "15.2(2)S2" }, { "product": "IOS", "range": "15.2(2)S0a" }, { "product": "IOS", "range": "15.2(2)S0c" }, { "product": "IOS", "range": "15.2(4)S1" }, { "product": "IOS", "range": "15.2(4)S4" }, { "product": "IOS", "range": "15.2(4)S6" }, { "product": "IOS", "range": "15.2(4)S2" }, { "product": "IOS", "range": "15.2(4)S5" }, { "product": "IOS", "range": "15.2(4)S3" }, { "product": "IOS", "range": "15.2(4)S3a" }, { "product": "IOS", "range": "15.2(4)S4a" }, { "product": "IOS", "range": "15.2(4)S7" }, { "product": "IOS", "range": "15.3(1)T" }, { "product": "IOS", "range": "15.3(2)T" }, { "product": "IOS", "range": "15.3(1)T1" }, { "product": "IOS", "range": "15.3(1)T2" }, { "product": "IOS", "range": "15.3(1)T3" }, { "product": "IOS", "range": "15.3(1)T4" }, { "product": "IOS", "range": "15.3(2)T1" }, { "product": "IOS", "range": "15.3(2)T2" }, { "product": "IOS", "range": "15.3(2)T3" }, { "product": "IOS", "range": "15.3(2)T4" }, { "product": "IOS", "range": "15.0(2)EY" }, { "product": "IOS", "range": "15.0(2)EY1" }, { "product": "IOS", "range": "15.0(2)EY2" }, { "product": "IOS", "range": "15.0(2)EY3" }, { "product": "IOS", "range": "15.1(2)S" }, { "product": "IOS", "range": "15.1(1)S" }, { "product": "IOS", "range": "15.1(1)S1" }, { "product": "IOS", "range": "15.1(3)S" }, { "product": "IOS", "range": "15.1(1)S2" }, { "product": "IOS", "range": "15.1(2)S1" }, { "product": "IOS", "range": "15.1(2)S2" }, { "product": "IOS", "range": "15.1(3)S1" }, { "product": "IOS", "range": "15.1(3)S0a" }, { "product": "IOS", "range": "15.1(3)S2" }, { "product": "IOS", "range": "15.1(3)S4" }, { "product": "IOS", "range": "15.1(3)S3" }, { "product": "IOS", "range": "15.1(3)S5" }, { "product": "IOS", "range": "15.1(3)S6" }, { "product": "IOS", "range": "15.1(3)S5a" }, { "product": "IOS", "range": "15.1(4)M3" }, { "product": "IOS", "range": "15.1(4)M" }, { "product": "IOS", "range": "15.1(4)M1" }, { "product": "IOS", "range": "15.1(4)M2" }, { "product": "IOS", "range": "15.1(4)M6" }, { "product": "IOS", "range": "15.1(4)M5" }, { "product": "IOS", "range": "15.1(4)M4" }, { "product": "IOS", "range": "15.1(4)M7" }, { "product": "IOS", "range": "15.1(4)M3a" }, { "product": "IOS", "range": "15.1(4)M10" }, { "product": "IOS", "range": "15.1(4)M8" }, { "product": "IOS", "range": "15.1(4)M9" }, { "product": "IOS", "range": "15.0(2)SE" }, { "product": "IOS", "range": "15.0(2)SE1" }, { "product": "IOS", "range": "15.0(2)SE2" }, { "product": "IOS", "range": "15.0(2)SE3" }, { "product": "IOS", "range": "15.0(2)SE4" }, { "product": "IOS", "range": "15.0(2)SE5" }, { "product": "IOS", "range": "15.0(2)SE6" }, { "product": "IOS", "range": "15.0(2)SE7" }, { "product": "IOS", "range": "15.0(2)SE8" }, { "product": "IOS", "range": "15.0(2)SE9" }, { "product": "IOS", "range": "15.0(2)SE10" }, { "product": "IOS", "range": "15.0(2)SE11" }, { "product": "IOS", "range": "15.0(2)SE10a" }, { "product": "IOS", "range": "15.0(2)SE12" }, { "product": "IOS", "range": "15.0(2)SE13" }, { "product": "IOS", "range": "15.1(2)GC" }, { "product": "IOS", "range": "15.1(2)GC1" }, { "product": "IOS", "range": "15.1(2)GC2" }, { "product": "IOS", "range": "15.1(4)GC" }, { "product": "IOS", "range": "15.1(4)GC1" }, { "product": "IOS", "range": "15.1(4)GC2" }, { "product": "IOS", "range": "15.1(1)SG" }, { "product": "IOS", "range": "15.1(2)SG" }, { "product": "IOS", "range": "15.1(1)SG1" }, { "product": "IOS", "range": "15.1(1)SG2" }, { "product": "IOS", "range": "15.1(2)SG1" }, { "product": "IOS", "range": "15.1(2)SG2" }, { "product": "IOS", "range": "15.1(2)SG3" }, { "product": "IOS", "range": "15.1(2)SG4" }, { "product": "IOS", "range": "15.1(2)SG5" }, { "product": "IOS", "range": "15.1(2)SG6" }, { "product": "IOS", "range": "15.1(2)SG7" }, { "product": "IOS", "range": "15.1(2)SG8" }, { "product": "IOS", "range": "15.0(1)MR" }, { "product": "IOS", "range": "15.0(2)MR" }, { "product": "IOS", "range": "15.2(4)M" }, { "product": "IOS", "range": "15.2(4)M1" }, { "product": "IOS", "range": "15.2(4)M2" }, { "product": "IOS", "range": "15.2(4)M4" }, { "product": "IOS", "range": "15.2(4)M3" }, { "product": "IOS", "range": "15.2(4)M5" }, { "product": "IOS", "range": "15.2(4)M8" }, { "product": "IOS", "range": "15.2(4)M10" }, { "product": "IOS", "range": "15.2(4)M7" }, { "product": "IOS", "range": "15.2(4)M6" }, { "product": "IOS", "range": "15.2(4)M9" }, { "product": "IOS", "range": "15.2(4)M6a" }, { "product": "IOS", "range": "15.2(4)M11" }, { "product": "IOS", "range": "12.4(24)MDB" }, { "product": "IOS", "range": "12.4(24)MDB1" }, { "product": "IOS", "range": "12.4(24)MDB3" }, { "product": "IOS", "range": "12.4(24)MDB4" }, { "product": "IOS", "range": "12.4(24)MDB5" }, { "product": "IOS", "range": "12.4(24)MDB6" }, { "product": "IOS", "range": "12.4(24)MDB7" }, { "product": "IOS", "range": "12.4(24)MDB5a" }, { "product": "IOS", "range": "12.4(24)MDB8" }, { "product": "IOS", "range": "12.4(24)MDB9" }, { "product": "IOS", "range": "12.4(24)MDB10" }, { "product": "IOS", "range": "12.4(24)MDB11" }, { "product": "IOS", "range": "12.4(24)MDB12" }, { "product": "IOS", "range": "12.4(24)MDB13" }, { "product": "IOS", "range": "12.4(24)MDB14" }, { "product": "IOS", "range": "12.4(24)MDB15" }, { "product": "IOS", "range": "12.4(24)MDB16" }, { "product": "IOS", "range": "12.4(24)MDB17" }, { "product": "IOS", "range": "12.4(24)MDB18" }, { "product": "IOS", "range": "12.4(24)MDB19" }, { "product": "IOS", "range": "15.0(2)EX" }, { "product": "IOS", "range": "15.0(2)EX1" }, { "product": "IOS", "range": "15.0(2)EX2" }, { "product": "IOS", "range": "15.0(2)EX3" }, { "product": "IOS", "range": "15.0(2)EX4" }, { "product": "IOS", "range": "15.0(2)EX5" }, { "product": "IOS", "range": "15.0(2)EX8" }, { "product": "IOS", "range": "15.0(2a)EX5" }, { "product": "IOS", "range": "15.0(2)EX10" }, { "product": "IOS", "range": "15.0(2)EX11" }, { "product": "IOS", "range": "15.0(2)EX13" }, { "product": "IOS", "range": "15.0(2)EX12" }, { "product": "IOS", "range": "15.2(1)GC" }, { "product": "IOS", "range": "15.2(1)GC1" }, { "product": "IOS", "range": "15.2(1)GC2" }, { "product": "IOS", "range": "15.2(2)GC" }, { "product": "IOS", "range": "15.2(3)GC" }, { "product": "IOS", "range": "15.2(3)GC1" }, { "product": "IOS", "range": "15.2(4)GC" }, { "product": "IOS", "range": "15.2(4)GC1" }, { "product": "IOS", "range": "15.2(4)GC2" }, { "product": "IOS", "range": "15.2(4)GC3" }, { "product": "IOS", "range": "15.1(1)SY" }, { "product": "IOS", "range": "15.1(1)SY1" }, { "product": "IOS", "range": "15.1(2)SY" }, { "product": "IOS", "range": "15.1(2)SY1" }, { "product": "IOS", "range": "15.1(2)SY2" }, { "product": "IOS", "range": "15.1(1)SY2" }, { "product": "IOS", "range": "15.1(1)SY3" }, { "product": "IOS", "range": "15.1(2)SY3" }, { "product": "IOS", "range": "15.1(1)SY4" }, { "product": "IOS", "range": "15.1(2)SY4" }, { "product": "IOS", "range": "15.1(1)SY5" }, { "product": "IOS", "range": "15.1(2)SY5" }, { "product": "IOS", "range": "15.1(2)SY4a" }, { "product": "IOS", "range": "15.1(1)SY6" }, { "product": "IOS", "range": "15.1(2)SY6" }, { "product": "IOS", "range": "15.1(2)SY7" }, { "product": "IOS", "range": "15.1(2)SY8" }, { "product": "IOS", "range": "15.1(2)SY9" }, { "product": "IOS", "range": "15.1(2)SY10" }, { "product": "IOS", "range": "15.1(2)SY11" }, { "product": "IOS", "range": "15.1(2)SY12" }, { "product": "IOS", "range": "15.1(2)SY13" }, { "product": "IOS", "range": "15.1(2)SY14" }, { "product": "IOS", "range": "15.1(2)SY15" }, { "product": "IOS", "range": "15.1(2)SY16" }, { "product": "IOS", "range": "15.3(1)S" }, { "product": "IOS", "range": "15.3(2)S" }, { "product": "IOS", "range": "15.3(3)S" }, { "product": "IOS", "range": "15.3(1)S2" }, { "product": "IOS", "range": "15.3(1)S1" }, { "product": "IOS", "range": "15.3(2)S2" }, { "product": "IOS", "range": "15.3(2)S1" }, { "product": "IOS", "range": "15.3(3)S1" }, { "product": "IOS", "range": "15.3(3)S2" }, { "product": "IOS", "range": "15.3(3)S3" }, { "product": "IOS", "range": "15.3(3)S6" }, { "product": "IOS", "range": "15.3(3)S4" }, { "product": "IOS", "range": "15.3(3)S1a" }, { "product": "IOS", "range": "15.3(3)S5" }, { "product": "IOS", "range": "15.3(3)S7" }, { "product": "IOS", "range": "15.3(3)S8" }, { "product": "IOS", "range": "15.3(3)S9" }, { "product": "IOS", "range": "15.3(3)S10" }, { "product": "IOS", "range": "15.3(3)S8a" }, { "product": "IOS", "range": "15.4(1)T" }, { "product": "IOS", "range": "15.4(2)T" }, { "product": "IOS", "range": "15.4(1)T2" }, { "product": "IOS", "range": "15.4(1)T1" }, { "product": "IOS", "range": "15.4(1)T3" }, { "product": "IOS", "range": "15.4(2)T1" }, { "product": "IOS", "range": "15.4(2)T3" }, { "product": "IOS", "range": "15.4(2)T2" }, { "product": "IOS", "range": "15.4(1)T4" }, { "product": "IOS", "range": "15.4(2)T4" }, { "product": "IOS", "range": "15.0(2)EA" }, { "product": "IOS", "range": "15.0(2)EA1" }, { "product": "IOS", "range": "15.2(1)E" }, { "product": "IOS", "range": "15.2(2)E" }, { "product": "IOS", "range": "15.2(1)E1" }, { "product": "IOS", "range": "15.2(3)E" }, { "product": "IOS", "range": "15.2(1)E2" }, { "product": "IOS", "range": "15.2(1)E3" }, { "product": "IOS", "range": "15.2(2)E1" }, { "product": "IOS", "range": "15.2(4)E" }, { "product": "IOS", "range": "15.2(3)E1" }, { "product": "IOS", "range": "15.2(2)E2" }, { "product": "IOS", "range": "15.2(2a)E1" }, { "product": "IOS", "range": "15.2(2)E3" }, { "product": "IOS", "range": "15.2(2a)E2" }, { "product": "IOS", "range": "15.2(3)E2" }, { "product": "IOS", "range": "15.2(3a)E" }, { "product": "IOS", "range": "15.2(3)E3" }, { "product": "IOS", "range": "15.2(4)E1" }, { "product": "IOS", "range": "15.2(2)E4" }, { "product": "IOS", "range": "15.2(2)E5" }, { "product": "IOS", "range": "15.2(4)E2" }, { "product": "IOS", "range": "15.2(3)E4" }, { "product": "IOS", "range": "15.2(5)E" }, { "product": "IOS", "range": "15.2(4)E3" }, { "product": "IOS", "range": "15.2(2)E6" }, { "product": "IOS", "range": "15.2(5a)E" }, { "product": "IOS", "range": "15.2(5)E1" }, { "product": "IOS", "range": "15.2(5b)E" }, { "product": "IOS", "range": "15.2(2)E5a" }, { "product": "IOS", "range": "15.2(5c)E" }, { "product": "IOS", "range": "15.2(3)E5" }, { "product": "IOS", "range": "15.2(2)E5b" }, { "product": "IOS", "range": "15.2(5a)E1" }, { "product": "IOS", "range": "15.2(4)E4" }, { "product": "IOS", "range": "15.2(2)E7" }, { "product": "IOS", "range": "15.2(5)E2" }, { "product": "IOS", "range": "15.2(6)E" }, { "product": "IOS", "range": "15.2(5)E2b" }, { "product": "IOS", "range": "15.2(4)E5" }, { "product": "IOS", "range": "15.2(5)E2c" }, { "product": "IOS", "range": "15.2(2)E8" }, { "product": "IOS", "range": "15.2(6)E0a" }, { "product": "IOS", "range": "15.2(6)E1" }, { "product": "IOS", "range": "15.2(2)E7b" }, { "product": "IOS", "range": "15.2(4)E5a" }, { "product": "IOS", "range": "15.2(6)E0c" }, { "product": "IOS", "range": "15.2(4)E6" }, { "product": "IOS", "range": "15.2(6)E2" }, { "product": "IOS", "range": "15.2(2)E9" }, { "product": "IOS", "range": "15.2(4)E7" }, { "product": "IOS", "range": "15.2(7)E" }, { "product": "IOS", "range": "15.2(2)E10" }, { "product": "IOS", "range": "15.2(4)E8" }, { "product": "IOS", "range": "15.2(6)E2a" }, { "product": "IOS", "range": "15.2(6)E2b" }, { "product": "IOS", "range": "15.2(7)E1" }, { "product": "IOS", "range": "15.2(7)E0a" }, { "product": "IOS", "range": "15.2(7)E0b" }, { "product": "IOS", "range": "15.2(7)E0s" }, { "product": "IOS", "range": "15.2(6)E3" }, { "product": "IOS", "range": "15.2(4)E9" }, { "product": "IOS", "range": "15.2(7)E2" }, { "product": "IOS", "range": "15.2(7a)E0b" }, { "product": "IOS", "range": "15.2(4)E10" }, { "product": "IOS", "range": "15.2(7)E3" }, { "product": "IOS", "range": "15.2(7)E1a" }, { "product": "IOS", "range": "15.2(7b)E0b" }, { "product": "IOS", "range": "15.2(7)E2a" }, { "product": "IOS", "range": "15.2(4)E10a" }, { "product": "IOS", "range": "15.2(7)E4" }, { "product": "IOS", "range": "15.2(7)E3k" }, { "product": "IOS", "range": "15.2(8)E" }, { "product": "IOS", "range": "15.2(8)E1" }, { "product": "IOS", "range": "15.2(7)E5" }, { "product": "IOS", "range": "15.2(7)E6" }, { "product": "IOS", "range": "15.2(8)E2" }, { "product": "IOS", "range": "15.2(4)E10d" }, { "product": "IOS", "range": "15.2(7)E7" }, { "product": "IOS", "range": "15.2(8)E3" }, { "product": "IOS", "range": "15.2(7)E8" }, { "product": "IOS", "range": "15.2(8)E4" }, { "product": "IOS", "range": "15.1(3)MRA" }, { "product": "IOS", "range": "15.1(3)MRA1" }, { "product": "IOS", "range": "15.1(3)MRA2" }, { "product": "IOS", "range": "15.1(3)MRA3" }, { "product": "IOS", "range": "15.1(3)MRA4" }, { "product": "IOS", "range": "15.1(3)SVB1" }, { "product": "IOS", "range": "15.1(3)SVB2" }, { "product": "IOS", "range": "15.4(1)S" }, { "product": "IOS", "range": "15.4(2)S" }, { "product": "IOS", "range": "15.4(3)S" }, { "product": "IOS", "range": "15.4(1)S1" }, { "product": "IOS", "range": "15.4(1)S2" }, { "product": "IOS", "range": "15.4(2)S1" }, { "product": "IOS", "range": "15.4(1)S3" }, { "product": "IOS", "range": "15.4(3)S1" }, { "product": "IOS", "range": "15.4(2)S2" }, { "product": "IOS", "range": "15.4(3)S2" }, { "product": "IOS", "range": "15.4(3)S3" }, { "product": "IOS", "range": "15.4(1)S4" }, { "product": "IOS", "range": "15.4(2)S3" }, { "product": "IOS", "range": "15.4(2)S4" }, { "product": "IOS", "range": "15.4(3)S4" }, { "product": "IOS", "range": "15.4(3)S5" }, { "product": "IOS", "range": "15.4(3)S6" }, { "product": "IOS", "range": "15.4(3)S7" }, { "product": "IOS", "range": "15.4(3)S6a" }, { "product": "IOS", "range": "15.4(3)S8" }, { "product": "IOS", "range": "15.4(3)S9" }, { "product": "IOS", "range": "15.4(3)S10" }, { "product": "IOS", "range": "15.3(3)M" }, { "product": "IOS", "range": "15.3(3)M1" }, { "product": "IOS", "range": "15.3(3)M2" }, { "product": "IOS", "range": "15.3(3)M3" }, { "product": "IOS", "range": "15.3(3)M5" }, { "product": "IOS", "range": "15.3(3)M4" }, { "product": "IOS", "range": "15.3(3)M6" }, { "product": "IOS", "range": "15.3(3)M7" }, { "product": "IOS", "range": "15.3(3)M8" }, { "product": "IOS", "range": "15.3(3)M9" }, { "product": "IOS", "range": "15.3(3)M10" }, { "product": "IOS", "range": "15.3(3)M8a" }, { "product": "IOS", "range": "15.0(2)EZ" }, { "product": "IOS", "range": "15.1(3)SVD" }, { "product": "IOS", "range": "15.1(3)SVD1" }, { "product": "IOS", "range": "15.1(3)SVD2" }, { "product": "IOS", "range": "15.2(1)EY" }, { "product": "IOS", "range": "15.0(2)EJ" }, { "product": "IOS", "range": "15.0(2)EJ1" }, { "product": "IOS", "range": "15.2(1)SY" }, { "product": "IOS", "range": "15.2(1)SY1" }, { "product": "IOS", "range": "15.2(1)SY0a" }, { "product": "IOS", "range": "15.2(1)SY2" }, { "product": "IOS", "range": "15.2(2)SY" }, { "product": "IOS", "range": "15.2(1)SY1a" }, { "product": "IOS", "range": "15.2(2)SY1" }, { "product": "IOS", "range": "15.2(2)SY2" }, { "product": "IOS", "range": "15.2(1)SY3" }, { "product": "IOS", "range": "15.2(1)SY4" }, { "product": "IOS", "range": "15.2(2)SY3" }, { "product": "IOS", "range": "15.2(1)SY5" }, { "product": "IOS", "range": "15.2(1)SY6" }, { "product": "IOS", "range": "15.2(1)SY7" }, { "product": "IOS", "range": "15.2(1)SY8" }, { "product": "IOS", "range": "15.2(5)EX" }, { "product": "IOS", "range": "15.1(3)SVF" }, { "product": "IOS", "range": "15.1(3)SVF1" }, { "product": "IOS", "range": "15.1(3)SVE" }, { "product": "IOS", "range": "15.4(3)M" }, { "product": "IOS", "range": "15.4(3)M1" }, { "product": "IOS", "range": "15.4(3)M2" }, { "product": "IOS", "range": "15.4(3)M3" }, { "product": "IOS", "range": "15.4(3)M4" }, { "product": "IOS", "range": "15.4(3)M5" }, { "product": "IOS", "range": "15.4(3)M6" }, { "product": "IOS", "range": "15.4(3)M7" }, { "product": "IOS", "range": "15.4(3)M6a" }, { "product": "IOS", "range": "15.4(3)M8" }, { "product": "IOS", "range": "15.4(3)M9" }, { "product": "IOS", "range": "15.4(3)M10" }, { "product": "IOS", "range": "15.0(2)EK" }, { "product": "IOS", "range": "15.0(2)EK1" }, { "product": "IOS", "range": "15.4(1)CG" }, { "product": "IOS", "range": "15.4(1)CG1" }, { "product": "IOS", "range": "15.4(2)CG" }, { "product": "IOS", "range": "15.5(1)S" }, { "product": "IOS", "range": "15.5(2)S" }, { "product": "IOS", "range": "15.5(1)S1" }, { "product": "IOS", "range": "15.5(3)S" }, { "product": "IOS", "range": "15.5(1)S2" }, { "product": "IOS", "range": "15.5(1)S3" }, { "product": "IOS", "range": "15.5(2)S1" }, { "product": "IOS", "range": "15.5(2)S2" }, { "product": "IOS", "range": "15.5(3)S1" }, { "product": "IOS", "range": "15.5(3)S1a" }, { "product": "IOS", "range": "15.5(2)S3" }, { "product": "IOS", "range": "15.5(3)S2" }, { "product": "IOS", "range": "15.5(3)S0a" }, { "product": "IOS", "range": "15.5(3)S3" }, { "product": "IOS", "range": "15.5(1)S4" }, { "product": "IOS", "range": "15.5(2)S4" }, { "product": "IOS", "range": "15.5(3)S4" }, { "product": "IOS", "range": "15.5(3)S5" }, { "product": "IOS", "range": "15.5(3)S6" }, { "product": "IOS", "range": "15.5(3)S6a" }, { "product": "IOS", "range": "15.5(3)S7" }, { "product": "IOS", "range": "15.5(3)S6b" }, { "product": "IOS", "range": "15.5(3)S8" }, { "product": "IOS", "range": "15.5(3)S9" }, { "product": "IOS", "range": "15.5(3)S10" }, { "product": "IOS", "range": "15.5(3)S9a" }, { "product": "IOS", "range": "15.1(3)SVG" }, { "product": "IOS", "range": "15.2(2)EB" }, { "product": "IOS", "range": "15.2(2)EB1" }, { "product": "IOS", "range": "15.2(2)EB2" }, { "product": "IOS", "range": "15.2(6)EB" }, { "product": "IOS", "range": "15.5(1)T" }, { "product": "IOS", "range": "15.5(1)T1" }, { "product": "IOS", "range": "15.5(2)T" }, { "product": "IOS", "range": "15.5(1)T2" }, { "product": "IOS", "range": "15.5(1)T3" }, { "product": "IOS", "range": "15.5(2)T1" }, { "product": "IOS", "range": "15.5(2)T2" }, { "product": "IOS", "range": "15.5(2)T3" }, { "product": "IOS", "range": "15.5(2)T4" }, { "product": "IOS", "range": "15.5(1)T4" }, { "product": "IOS", "range": "15.2(2)EA" }, { "product": "IOS", "range": "15.2(2)EA1" }, { "product": "IOS", "range": "15.2(2)EA2" }, { "product": "IOS", "range": "15.2(3)EA" }, { "product": "IOS", "range": "15.2(4)EA" }, { "product": "IOS", "range": "15.2(4)EA1" }, { "product": "IOS", "range": "15.2(2)EA3" }, { "product": "IOS", "range": "15.2(4)EA3" }, { "product": "IOS", "range": "15.2(5)EA" }, { "product": "IOS", "range": "15.2(4)EA4" }, { "product": "IOS", "range": "15.2(4)EA5" }, { "product": "IOS", "range": "15.2(4)EA6" }, { "product": "IOS", "range": "15.2(4)EA7" }, { "product": "IOS", "range": "15.2(4)EA8" }, { "product": "IOS", "range": "15.2(4)EA9" }, { "product": "IOS", "range": "15.2(4)EA9a" }, { "product": "IOS", "range": "15.5(3)M" }, { "product": "IOS", "range": "15.5(3)M1" }, { "product": "IOS", "range": "15.5(3)M0a" }, { "product": "IOS", "range": "15.5(3)M2" }, { "product": "IOS", "range": "15.5(3)M3" }, { "product": "IOS", "range": "15.5(3)M4" }, { "product": "IOS", "range": "15.5(3)M4a" }, { "product": "IOS", "range": "15.5(3)M5" }, { "product": "IOS", "range": "15.5(3)M6" }, { "product": "IOS", "range": "15.5(3)M7" }, { "product": "IOS", "range": "15.5(3)M6a" }, { "product": "IOS", "range": "15.5(3)M8" }, { "product": "IOS", "range": "15.5(3)M9" }, { "product": "IOS", "range": "15.5(3)M10" }, { "product": "IOS", "range": "15.5(3)SN" }, { "product": "IOS", "range": "15.6(1)S" }, { "product": "IOS", "range": "15.6(2)S" }, { "product": "IOS", "range": "15.6(2)S1" }, { "product": "IOS", "range": "15.6(1)S1" }, { "product": "IOS", "range": "15.6(1)S2" }, { "product": "IOS", "range": "15.6(2)S2" }, { "product": "IOS", "range": "15.6(1)S3" }, { "product": "IOS", "range": "15.6(2)S3" }, { "product": "IOS", "range": "15.6(1)S4" }, { "product": "IOS", "range": "15.6(2)S4" }, { "product": "IOS", "range": "15.6(1)T" }, { "product": "IOS", "range": "15.6(2)T" }, { "product": "IOS", "range": "15.6(1)T0a" }, { "product": "IOS", "range": "15.6(1)T1" }, { "product": "IOS", "range": "15.6(2)T1" }, { "product": "IOS", "range": "15.6(1)T2" }, { "product": "IOS", "range": "15.6(2)T2" }, { "product": "IOS", "range": "15.6(1)T3" }, { "product": "IOS", "range": "15.6(2)T3" }, { "product": "IOS", "range": "15.3(1)SY" }, { "product": "IOS", "range": "15.3(1)SY1" }, { "product": "IOS", "range": "15.3(1)SY2" }, { "product": "IOS", "range": "15.6(2)SP" }, { "product": "IOS", "range": "15.6(2)SP1" }, { "product": "IOS", "range": "15.6(2)SP2" }, { "product": "IOS", "range": "15.6(2)SP3" }, { "product": "IOS", "range": "15.6(2)SP4" }, { "product": "IOS", "range": "15.6(2)SP5" }, { "product": "IOS", "range": "15.6(2)SP6" }, { "product": "IOS", "range": "15.6(2)SP7" }, { "product": "IOS", "range": "15.6(2)SP8" }, { "product": "IOS", "range": "15.6(2)SP9" }, { "product": "IOS", "range": "15.6(2)SP10" }, { "product": "IOS", "range": "15.6(2)SN" }, { "product": "IOS", "range": "15.6(3)M" }, { "product": "IOS", "range": "15.6(3)M1" }, { "product": "IOS", "range": "15.6(3)M0a" }, { "product": "IOS", "range": "15.6(3)M1b" }, { "product": "IOS", "range": "15.6(3)M2" }, { "product": "IOS", "range": "15.6(3)M2a" }, { "product": "IOS", "range": "15.6(3)M3" }, { "product": "IOS", "range": "15.6(3)M3a" }, { "product": "IOS", "range": "15.6(3)M4" }, { "product": "IOS", "range": "15.6(3)M5" }, { "product": "IOS", "range": "15.6(3)M6" }, { "product": "IOS", "range": "15.6(3)M7" }, { "product": "IOS", "range": "15.6(3)M6a" }, { "product": "IOS", "range": "15.6(3)M6b" }, { "product": "IOS", "range": "15.6(3)M8" }, { "product": "IOS", "range": "15.6(3)M9" }, { "product": "IOS", "range": "15.1(3)SVJ2" }, { "product": "IOS", "range": "15.2(4)EC1" }, { "product": "IOS", "range": "15.2(4)EC2" }, { "product": "IOS", "range": "15.4(1)SY" }, { "product": "IOS", "range": "15.4(1)SY1" }, { "product": "IOS", "range": "15.4(1)SY2" }, { "product": "IOS", "range": "15.4(1)SY3" }, { "product": "IOS", "range": "15.4(1)SY4" }, { "product": "IOS", "range": "15.5(1)SY" }, { "product": "IOS", "range": "15.5(1)SY1" }, { "product": "IOS", "range": "15.5(1)SY2" }, { "product": "IOS", "range": "15.5(1)SY3" }, { "product": "IOS", "range": "15.5(1)SY4" }, { "product": "IOS", "range": "15.5(1)SY5" }, { "product": "IOS", "range": "15.5(1)SY6" }, { "product": "IOS", "range": "15.5(1)SY7" }, { "product": "IOS", "range": "15.5(1)SY8" }, { "product": "IOS", "range": "15.5(1)SY9" }, { "product": "IOS", "range": "15.5(1)SY10" }, { "product": "IOS", "range": "15.5(1)SY11" }, { "product": "IOS", "range": "15.7(3)M" }, { "product": "IOS", "range": "15.7(3)M1" }, { "product": "IOS", "range": "15.7(3)M0a" }, { "product": "IOS", "range": "15.7(3)M3" }, { "product": "IOS", "range": "15.7(3)M2" }, { "product": "IOS", "range": "15.7(3)M4" }, { "product": "IOS", "range": "15.7(3)M5" }, { "product": "IOS", "range": "15.7(3)M4a" }, { "product": "IOS", "range": "15.7(3)M4b" }, { "product": "IOS", "range": "15.7(3)M6" }, { "product": "IOS", "range": "15.7(3)M7" }, { "product": "IOS", "range": "15.7(3)M8" }, { "product": "IOS", "range": "15.7(3)M9" }, { "product": "IOS", "range": "15.8(3)M" }, { "product": "IOS", "range": "15.8(3)M1" }, { "product": "IOS", "range": "15.8(3)M0a" }, { "product": "IOS", "range": "15.8(3)M0b" }, { "product": "IOS", "range": "15.8(3)M2" }, { "product": "IOS", "range": "15.8(3)M1a" }, { "product": "IOS", "range": "15.8(3)M3" }, { "product": "IOS", "range": "15.8(3)M2a" }, { "product": "IOS", "range": "15.8(3)M4" }, { "product": "IOS", "range": "15.8(3)M3a" }, { "product": "IOS", "range": "15.8(3)M3b" }, { "product": "IOS", "range": "15.8(3)M5" }, { "product": "IOS", "range": "15.8(3)M6" }, { "product": "IOS", "range": "15.8(3)M7" }, { "product": "IOS", "range": "15.8(3)M8" }, { "product": "IOS", "range": "15.8(3)M9" }, { "product": "IOS", "range": "15.8(3)M10" }, { "product": "IOS", "range": "15.9(3)M" }, { "product": "IOS", "range": "15.9(3)M1" }, { "product": "IOS", "range": "15.9(3)M0a" }, { "product": "IOS", "range": "15.9(3)M2" }, { "product": "IOS", "range": "15.9(3)M3" }, { "product": "IOS", "range": "15.9(3)M2a" }, { "product": "IOS", "range": "15.9(3)M3a" }, { "product": "IOS", "range": "15.9(3)M4" }, { "product": "IOS", "range": "15.9(3)M3b" }, { "product": "IOS", "range": "15.9(3)M5" }, { "product": "IOS", "range": "15.9(3)M4a" }, { "product": "IOS", "range": "15.9(3)M6" }, { "product": "IOS", "range": "15.9(3)M7" }, { "product": "IOS", "range": "15.9(3)M6a" }, { "product": "IOS", "range": "15.9(3)M6b" }, { "product": "IOS", "range": "15.9(3)M7a" }, { "product": "Cisco IOS XE Software", "range": "3.7.0S" }, { "product": "Cisco IOS XE Software", "range": "3.7.1S" }, { "product": "Cisco IOS XE Software", "range": "3.7.2S" }, { "product": "Cisco IOS XE Software", "range": "3.7.3S" }, { "product": "Cisco IOS XE Software", "range": "3.7.4S" }, { "product": "Cisco IOS XE Software", "range": "3.7.5S" }, { "product": "Cisco IOS XE Software", "range": "3.7.6S" }, { "product": "Cisco IOS XE Software", "range": "3.7.7S" }, { "product": "Cisco IOS XE Software", "range": "3.7.4aS" }, { "product": "Cisco IOS XE Software", "range": "3.7.2tS" }, { "product": "Cisco IOS XE Software", "range": "3.7.0bS" }, { "product": "Cisco IOS XE Software", "range": "3.7.1aS" }, { "product": "Cisco IOS XE Software", "range": "3.3.0SG" }, { "product": "Cisco IOS XE Software", "range": "3.3.2SG" }, { "product": "Cisco IOS XE Software", "range": "3.3.1SG" }, { "product": "Cisco IOS XE Software", "range": "3.8.0S" }, { "product": "Cisco IOS XE Software", "range": "3.8.1S" }, { "product": "Cisco IOS XE Software", "range": "3.8.2S" }, { "product": "Cisco IOS XE Software", "range": "3.9.1S" }, { "product": "Cisco IOS XE Software", "range": "3.9.0S" }, { "product": "Cisco IOS XE Software", "range": "3.9.2S" }, { "product": "Cisco IOS XE Software", "range": "3.9.1aS" }, { "product": "Cisco IOS XE Software", "range": "3.9.0aS" }, { "product": "Cisco IOS XE Software", "range": "3.4.0SG" }, { "product": "Cisco IOS XE Software", "range": "3.4.2SG" }, { "product": "Cisco IOS XE Software", "range": "3.4.1SG" }, { "product": "Cisco IOS XE Software", "range": "3.4.3SG" }, { "product": "Cisco IOS XE Software", "range": "3.4.4SG" }, { "product": "Cisco IOS XE Software", "range": "3.4.5SG" }, { "product": "Cisco IOS XE Software", "range": "3.4.6SG" }, { "product": "Cisco IOS XE Software", "range": "3.4.7SG" }, { "product": "Cisco IOS XE Software", "range": "3.4.8SG" }, { "product": "Cisco IOS XE Software", "range": "3.5.0E" }, { "product": "Cisco IOS XE Software", "range": "3.5.1E" }, { "product": "Cisco IOS XE Software", "range": "3.5.2E" }, { "product": "Cisco IOS XE Software", "range": "3.5.3E" }, { "product": "Cisco IOS XE Software", "range": "3.10.0S" }, { "product": "Cisco IOS XE Software", "range": "3.10.1S" }, { "product": "Cisco IOS XE Software", "range": "3.10.2S" }, { "product": "Cisco IOS XE Software", "range": "3.10.3S" }, { "product": "Cisco IOS XE Software", "range": "3.10.4S" }, { "product": "Cisco IOS XE Software", "range": "3.10.5S" }, { "product": "Cisco IOS XE Software", "range": "3.10.6S" }, { "product": "Cisco IOS XE Software", "range": "3.10.2tS" }, { "product": "Cisco IOS XE Software", "range": "3.10.7S" }, { "product": "Cisco IOS XE Software", "range": "3.10.1xbS" }, { "product": "Cisco IOS XE Software", "range": "3.10.8S" }, { "product": "Cisco IOS XE Software", "range": "3.10.8aS" }, { "product": "Cisco IOS XE Software", "range": "3.10.9S" }, { "product": "Cisco IOS XE Software", "range": "3.10.10S" }, { "product": "Cisco IOS XE Software", "range": "3.11.1S" }, { "product": "Cisco IOS XE Software", "range": "3.11.2S" }, { "product": "Cisco IOS XE Software", "range": "3.11.0S" }, { "product": "Cisco IOS XE Software", "range": "3.11.3S" }, { "product": "Cisco IOS XE Software", "range": "3.11.4S" }, { "product": "Cisco IOS XE Software", "range": "3.12.0S" }, { "product": "Cisco IOS XE Software", "range": "3.12.1S" }, { "product": "Cisco IOS XE Software", "range": "3.12.2S" }, { "product": "Cisco IOS XE Software", "range": "3.12.3S" }, { "product": "Cisco IOS XE Software", "range": "3.12.0aS" }, { "product": "Cisco IOS XE Software", "range": "3.12.4S" }, { "product": "Cisco IOS XE Software", "range": "3.13.0S" }, { "product": "Cisco IOS XE Software", "range": "3.13.1S" }, { "product": "Cisco IOS XE Software", "range": "3.13.2S" }, { "product": "Cisco IOS XE Software", "range": "3.13.3S" }, { "product": "Cisco IOS XE Software", "range": "3.13.4S" }, { "product": "Cisco IOS XE Software", "range": "3.13.5S" }, { "product": "Cisco IOS XE Software", "range": "3.13.2aS" }, { "product": "Cisco IOS XE Software", "range": "3.13.0aS" }, { "product": "Cisco IOS XE Software", "range": "3.13.5aS" }, { "product": "Cisco IOS XE Software", "range": "3.13.6S" }, { "product": "Cisco IOS XE Software", "range": "3.13.7S" }, { "product": "Cisco IOS XE Software", "range": "3.13.6aS" }, { "product": "Cisco IOS XE Software", "range": "3.13.7aS" }, { "product": "Cisco IOS XE Software", "range": "3.13.8S" }, { "product": "Cisco IOS XE Software", "range": "3.13.9S" }, { "product": "Cisco IOS XE Software", "range": "3.13.10S" }, { "product": "Cisco IOS XE Software", "range": "3.6.0E" }, { "product": "Cisco IOS XE Software", "range": "3.6.1E" }, { "product": "Cisco IOS XE Software", "range": "3.6.2aE" }, { "product": "Cisco IOS XE Software", "range": "3.6.2E" }, { "product": "Cisco IOS XE Software", "range": "3.6.3E" }, { "product": "Cisco IOS XE Software", "range": "3.6.4E" }, { "product": "Cisco IOS XE Software", "range": "3.6.5E" }, { "product": "Cisco IOS XE Software", "range": "3.6.6E" }, { "product": "Cisco IOS XE Software", "range": "3.6.5aE" }, { "product": "Cisco IOS XE Software", "range": "3.6.5bE" }, { "product": "Cisco IOS XE Software", "range": "3.6.7E" }, { "product": "Cisco IOS XE Software", "range": "3.6.8E" }, { "product": "Cisco IOS XE Software", "range": "3.6.7bE" }, { "product": "Cisco IOS XE Software", "range": "3.6.9E" }, { "product": "Cisco IOS XE Software", "range": "3.6.10E" }, { "product": "Cisco IOS XE Software", "range": "3.14.0S" }, { "product": "Cisco IOS XE Software", "range": "3.14.1S" }, { "product": "Cisco IOS XE Software", "range": "3.14.2S" }, { "product": "Cisco IOS XE Software", "range": "3.14.3S" }, { "product": "Cisco IOS XE Software", "range": "3.14.4S" }, { "product": "Cisco IOS XE Software", "range": "3.15.0S" }, { "product": "Cisco IOS XE Software", "range": "3.15.1S" }, { "product": "Cisco IOS XE Software", "range": "3.15.2S" }, { "product": "Cisco IOS XE Software", "range": "3.15.1cS" }, { "product": "Cisco IOS XE Software", "range": "3.15.3S" }, { "product": "Cisco IOS XE Software", "range": "3.15.4S" }, { "product": "Cisco IOS XE Software", "range": "3.16.0S" }, { "product": "Cisco IOS XE Software", "range": "3.16.1S" }, { "product": "Cisco IOS XE Software", "range": "3.16.1aS" }, { "product": "Cisco IOS XE Software", "range": "3.16.2S" }, { "product": "Cisco IOS XE Software", "range": "3.16.2aS" }, { "product": "Cisco IOS XE Software", "range": "3.16.0cS" }, { "product": "Cisco IOS XE Software", "range": "3.16.3S" }, { "product": "Cisco IOS XE Software", "range": "3.16.2bS" }, { "product": "Cisco IOS XE Software", "range": "3.16.3aS" }, { "product": "Cisco IOS XE Software", "range": "3.16.4S" }, { "product": "Cisco IOS XE Software", "range": "3.16.4aS" }, { "product": "Cisco IOS XE Software", "range": "3.16.4bS" }, { "product": "Cisco IOS XE Software", "range": "3.16.5S" }, { "product": "Cisco IOS XE Software", "range": "3.16.4dS" }, { "product": "Cisco IOS XE Software", "range": "3.16.6S" }, { "product": "Cisco IOS XE Software", "range": "3.16.7S" }, { "product": "Cisco IOS XE Software", "range": "3.16.6bS" }, { "product": "Cisco IOS XE Software", "range": "3.16.7aS" }, { "product": "Cisco IOS XE Software", "range": "3.16.7bS" }, { "product": "Cisco IOS XE Software", "range": "3.16.8S" }, { "product": "Cisco IOS XE Software", "range": "3.16.9S" }, { "product": "Cisco IOS XE Software", "range": "3.16.10S" }, { "product": "Cisco IOS XE Software", "range": "3.17.0S" }, { "product": "Cisco IOS XE Software", "range": "3.17.1S" }, { "product": "Cisco IOS XE Software", "range": "3.17.2S" }, { "product": "Cisco IOS XE Software", "range": "3.17.1aS" }, { "product": "Cisco IOS XE Software", "range": "3.17.3S" }, { "product": "Cisco IOS XE Software", "range": "3.17.4S" }, { "product": "Cisco IOS XE Software", "range": "16.1.1" }, { "product": "Cisco IOS XE Software", "range": "16.1.2" }, { "product": "Cisco IOS XE Software", "range": "16.1.3" }, { "product": "Cisco IOS XE Software", "range": "16.2.1" }, { "product": "Cisco IOS XE Software", "range": "16.2.2" }, { "product": "Cisco IOS XE Software", "range": "3.8.0E" }, { "product": "Cisco IOS XE Software", "range": "3.8.1E" }, { "product": "Cisco IOS XE Software", "range": "3.8.2E" }, { "product": "Cisco IOS XE Software", "range": "3.8.3E" }, { "product": "Cisco IOS XE Software", "range": "3.8.4E" }, { "product": "Cisco IOS XE Software", "range": "3.8.5E" }, { "product": "Cisco IOS XE Software", "range": "3.8.5aE" }, { "product": "Cisco IOS XE Software", "range": "3.8.6E" }, { "product": "Cisco IOS XE Software", "range": "3.8.7E" }, { "product": "Cisco IOS XE Software", "range": "3.8.8E" }, { "product": "Cisco IOS XE Software", "range": "3.8.9E" }, { "product": "Cisco IOS XE Software", "range": "3.8.10E" }, { "product": "Cisco IOS XE Software", "range": "16.3.1" }, { "product": "Cisco IOS XE Software", "range": "16.3.2" }, { "product": "Cisco IOS XE Software", "range": "16.3.3" }, { "product": "Cisco IOS XE Software", "range": "16.3.1a" }, { "product": "Cisco IOS XE Software", "range": "16.3.4" }, { "product": "Cisco IOS XE Software", "range": "16.3.5" }, { "product": "Cisco IOS XE Software", "range": "16.3.5b" }, { "product": "Cisco IOS XE Software", "range": "16.3.6" }, { "product": "Cisco IOS XE Software", "range": "16.3.7" }, { "product": "Cisco IOS XE Software", "range": "16.3.8" }, { "product": "Cisco IOS XE Software", "range": "16.3.9" }, { "product": "Cisco IOS XE Software", "range": "16.3.10" }, { "product": "Cisco IOS XE Software", "range": "16.3.11" }, { "product": "Cisco IOS XE Software", "range": "16.4.1" }, { "product": "Cisco IOS XE Software", "range": "16.4.2" }, { "product": "Cisco IOS XE Software", "range": "16.4.3" }, { "product": "Cisco IOS XE Software", "range": "16.5.1" }, { "product": "Cisco IOS XE Software", "range": "16.5.1a" }, { "product": "Cisco IOS XE Software", "range": "16.5.1b" }, { "product": "Cisco IOS XE Software", "range": "16.5.2" }, { "product": "Cisco IOS XE Software", "range": "16.5.3" }, { "product": "Cisco IOS XE Software", "range": "3.18.0aS" }, { "product": "Cisco IOS XE Software", "range": "3.18.0S" }, { "product": "Cisco IOS XE Software", "range": "3.18.1S" }, { "product": "Cisco IOS XE Software", "range": "3.18.2S" }, { "product": "Cisco IOS XE Software", "range": "3.18.3S" }, { "product": "Cisco IOS XE Software", "range": "3.18.4S" }, { "product": "Cisco IOS XE Software", "range": "3.18.0SP" }, { "product": "Cisco IOS XE Software", "range": "3.18.1SP" }, { "product": "Cisco IOS XE Software", "range": "3.18.1aSP" }, { "product": "Cisco IOS XE Software", "range": "3.18.1bSP" }, { "product": "Cisco IOS XE Software", "range": "3.18.1cSP" }, { "product": "Cisco IOS XE Software", "range": "3.18.2SP" }, { "product": "Cisco IOS XE Software", "range": "3.18.2aSP" }, { "product": "Cisco IOS XE Software", "range": "3.18.3SP" }, { "product": "Cisco IOS XE Software", "range": "3.18.4SP" }, { "product": "Cisco IOS XE Software", "range": "3.18.3aSP" }, { "product": "Cisco IOS XE Software", "range": "3.18.3bSP" }, { "product": "Cisco IOS XE Software", "range": "3.18.5SP" }, { "product": "Cisco IOS XE Software", "range": "3.18.6SP" }, { "product": "Cisco IOS XE Software", "range": "3.18.7SP" }, { "product": "Cisco IOS XE Software", "range": "3.18.8aSP" }, { "product": "Cisco IOS XE Software", "range": "3.18.9SP" }, { "product": "Cisco IOS XE Software", "range": "3.9.0E" }, { "product": "Cisco IOS XE Software", "range": "3.9.1E" }, { "product": "Cisco IOS XE Software", "range": "3.9.2E" }, { "product": "Cisco IOS XE Software", "range": "16.6.1" }, { "product": "Cisco IOS XE Software", "range": "16.6.2" }, { "product": "Cisco IOS XE Software", "range": "16.6.3" }, { "product": "Cisco IOS XE Software", "range": "16.6.4" }, { "product": "Cisco IOS XE Software", "range": "16.6.5" }, { "product": "Cisco IOS XE Software", "range": "16.6.4a" }, { "product": "Cisco IOS XE Software", "range": "16.6.5a" }, { "product": "Cisco IOS XE Software", "range": "16.6.6" }, { "product": "Cisco IOS XE Software", "range": "16.6.7" }, { "product": "Cisco IOS XE Software", "range": "16.6.8" }, { "product": "Cisco IOS XE Software", "range": "16.6.9" }, { "product": "Cisco IOS XE Software", "range": "16.6.10" }, { "product": "Cisco IOS XE Software", "range": "16.7.1" }, { "product": "Cisco IOS XE Software", "range": "16.7.1a" }, { "product": "Cisco IOS XE Software", "range": "16.7.1b" }, { "product": "Cisco IOS XE Software", "range": "16.7.2" }, { "product": "Cisco IOS XE Software", "range": "16.7.3" }, { "product": "Cisco IOS XE Software", "range": "16.7.4" }, { "product": "Cisco IOS XE Software", "range": "16.8.1" }, { "product": "Cisco IOS XE Software", "range": "16.8.1a" }, { "product": "Cisco IOS XE Software", "range": "16.8.1b" }, { "product": "Cisco IOS XE Software", "range": "16.8.1s" }, { "product": "Cisco IOS XE Software", "range": "16.8.1c" }, { "product": "Cisco IOS XE Software", "range": "16.8.1d" }, { "product": "Cisco IOS XE Software", "range": "16.8.2" }, { "product": "Cisco IOS XE Software", "range": "16.8.1e" }, { "product": "Cisco IOS XE Software", "range": "16.8.3" }, { "product": "Cisco IOS XE Software", "range": "16.9.1" }, { "product": "Cisco IOS XE Software", "range": "16.9.2" }, { "product": "Cisco IOS XE Software", "range": "16.9.1a" }, { "product": "Cisco IOS XE Software", "range": "16.9.1b" }, { "product": "Cisco IOS XE Software", "range": "16.9.1s" }, { "product": "Cisco IOS XE Software", "range": "16.9.3" }, { "product": "Cisco IOS XE Software", "range": "16.9.4" }, { "product": "Cisco IOS XE Software", "range": "16.9.3a" }, { "product": "Cisco IOS XE Software", "range": "16.9.5" }, { "product": "Cisco IOS XE Software", "range": "16.9.5f" }, { "product": "Cisco IOS XE Software", "range": "16.9.6" }, { "product": "Cisco IOS XE Software", "range": "16.9.7" }, { "product": "Cisco IOS XE Software", "range": "16.9.8" }, { "product": "Cisco IOS XE Software", "range": "16.10.1" }, { "product": "Cisco IOS XE Software", "range": "16.10.1a" }, { "product": "Cisco IOS XE Software", "range": "16.10.1b" }, { "product": "Cisco IOS XE Software", "range": "16.10.1s" }, { "product": "Cisco IOS XE Software", "range": "16.10.1c" }, { "product": "Cisco IOS XE Software", "range": "16.10.1e" }, { "product": "Cisco IOS XE Software", "range": "16.10.1d" }, { "product": "Cisco IOS XE Software", "range": "16.10.2" }, { "product": "Cisco IOS XE Software", "range": "16.10.1f" }, { "product": "Cisco IOS XE Software", "range": "16.10.1g" }, { "product": "Cisco IOS XE Software", "range": "16.10.3" }, { "product": "Cisco IOS XE Software", "range": "3.10.0E" }, { "product": "Cisco IOS XE Software", "range": "3.10.1E" }, { "product": "Cisco IOS XE Software", "range": "3.10.0cE" }, { "product": "Cisco IOS XE Software", "range": "3.10.2E" }, { "product": "Cisco IOS XE Software", "range": "3.10.3E" }, { "product": "Cisco IOS XE Software", "range": "16.11.1" }, { "product": "Cisco IOS XE Software", "range": "16.11.1a" }, { "product": "Cisco IOS XE Software", "range": "16.11.1b" }, { "product": "Cisco IOS XE Software", "range": "16.11.2" }, { "product": "Cisco IOS XE Software", "range": "16.11.1s" }, { "product": "Cisco IOS XE Software", "range": "16.12.1" }, { "product": "Cisco IOS XE Software", "range": "16.12.1s" }, { "product": "Cisco IOS XE Software", "range": "16.12.1a" }, { "product": "Cisco IOS XE Software", "range": "16.12.1c" }, { "product": "Cisco IOS XE Software", "range": "16.12.1w" }, { "product": "Cisco IOS XE Software", "range": "16.12.2" }, { "product": "Cisco IOS XE Software", "range": "16.12.1y" }, { "product": "Cisco IOS XE Software", "range": "16.12.2a" }, { "product": "Cisco IOS XE Software", "range": "16.12.3" }, { "product": "Cisco IOS XE Software", "range": "16.12.8" }, { "product": "Cisco IOS XE Software", "range": "16.12.2s" }, { "product": "Cisco IOS XE Software", "range": "16.12.1x" }, { "product": "Cisco IOS XE Software", "range": "16.12.1t" }, { "product": "Cisco IOS XE Software", "range": "16.12.4" }, { "product": "Cisco IOS XE Software", "range": "16.12.3s" }, { "product": "Cisco IOS XE Software", "range": "16.12.3a" }, { "product": "Cisco IOS XE Software", "range": "16.12.4a" }, { "product": "Cisco IOS XE Software", "range": "16.12.5" }, { "product": "Cisco IOS XE Software", "range": "16.12.6" }, { "product": "Cisco IOS XE Software", "range": "16.12.1z1" }, { "product": "Cisco IOS XE Software", "range": "16.12.5a" }, { "product": "Cisco IOS XE Software", "range": "16.12.5b" }, { "product": "Cisco IOS XE Software", "range": "16.12.1z2" }, { "product": "Cisco IOS XE Software", "range": "16.12.6a" }, { "product": "Cisco IOS XE Software", "range": "16.12.7" }, { "product": "Cisco IOS XE Software", "range": "16.12.9" }, { "product": "Cisco IOS XE Software", "range": "3.11.0E" }, { "product": "Cisco IOS XE Software", "range": "3.11.1E" }, { "product": "Cisco IOS XE Software", "range": "3.11.2E" }, { "product": "Cisco IOS XE Software", "range": "3.11.3E" }, { "product": "Cisco IOS XE Software", "range": "3.11.1aE" }, { "product": "Cisco IOS XE Software", "range": "3.11.4E" }, { "product": "Cisco IOS XE Software", "range": "3.11.3aE" }, { "product": "Cisco IOS XE Software", "range": "3.11.5E" }, { "product": "Cisco IOS XE Software", "range": "3.11.6E" }, { "product": "Cisco IOS XE Software", "range": "3.11.7E" }, { "product": "Cisco IOS XE Software", "range": "3.11.8E" }, { "product": "Cisco IOS XE Software", "range": "17.1.1" }, { "product": "Cisco IOS XE Software", "range": "17.1.1a" }, { "product": "Cisco IOS XE Software", "range": "17.1.1s" }, { "product": "Cisco IOS XE Software", "range": "17.1.1t" }, { "product": "Cisco IOS XE Software", "range": "17.1.3" }, { "product": "Cisco IOS XE Software", "range": "17.2.1" }, { "product": "Cisco IOS XE Software", "range": "17.2.1r" }, { "product": "Cisco IOS XE Software", "range": "17.2.1a" }, { "product": "Cisco IOS XE Software", "range": "17.2.1v" }, { "product": "Cisco IOS XE Software", "range": "17.2.2" }, { "product": "Cisco IOS XE Software", "range": "17.2.3" }, { "product": "Cisco IOS XE Software", "range": "17.3.1" }, { "product": "Cisco IOS XE Software", "range": "17.3.2" }, { "product": "Cisco IOS XE Software", "range": "17.3.3" }, { "product": "Cisco IOS XE Software", "range": "17.3.1a" }, { "product": "Cisco IOS XE Software", "range": "17.3.1w" }, { "product": "Cisco IOS XE Software", "range": "17.3.2a" }, { "product": "Cisco IOS XE Software", "range": "17.3.1x" }, { "product": "Cisco IOS XE Software", "range": "17.3.1z" }, { "product": "Cisco IOS XE Software", "range": "17.3.4" }, { "product": "Cisco IOS XE Software", "range": "17.3.5" }, { "product": "Cisco IOS XE Software", "range": "17.3.4a" }, { "product": "Cisco IOS XE Software", "range": "17.3.6" }, { "product": "Cisco IOS XE Software", "range": "17.3.4b" }, { "product": "Cisco IOS XE Software", "range": "17.3.4c" }, { "product": "Cisco IOS XE Software", "range": "17.3.5a" }, { "product": "Cisco IOS XE Software", "range": "17.3.5b" }, { "product": "Cisco IOS XE Software", "range": "17.3.7" }, { "product": "Cisco IOS XE Software", "range": "17.4.1" }, { "product": "Cisco IOS XE Software", "range": "17.4.2" }, { "product": "Cisco IOS XE Software", "range": "17.4.1a" }, { "product": "Cisco IOS XE Software", "range": "17.4.1b" }, { "product": "Cisco IOS XE Software", "range": "17.4.2a" }, { "product": "Cisco IOS XE Software", "range": "17.5.1" }, { "product": "Cisco IOS XE Software", "range": "17.5.1a" }, { "product": "Cisco IOS XE Software", "range": "17.5.1c" }, { "product": "Cisco IOS XE Software", "range": "17.6.1" }, { "product": "Cisco IOS XE Software", "range": "17.6.2" }, { "product": "Cisco IOS XE Software", "range": "17.6.1w" }, { "product": "Cisco IOS XE Software", "range": "17.6.1a" }, { "product": "Cisco IOS XE Software", "range": "17.6.1x" }, { "product": "Cisco IOS XE Software", "range": "17.6.3" }, { "product": "Cisco IOS XE Software", "range": "17.6.1y" }, { "product": "Cisco IOS XE Software", "range": "17.6.1z" }, { "product": "Cisco IOS XE Software", "range": "17.6.3a" }, { "product": "Cisco IOS XE Software", "range": "17.6.4" }, { "product": "Cisco IOS XE Software", "range": "17.6.1z1" }, { "product": "Cisco IOS XE Software", "range": "17.6.5" }, { "product": "Cisco IOS XE Software", "range": "17.6.5a" }, { "product": "Cisco IOS XE Software", "range": "17.7.1" }, { "product": "Cisco IOS XE Software", "range": "17.7.1a" }, { "product": "Cisco IOS XE Software", "range": "17.7.1b" }, { "product": "Cisco IOS XE Software", "range": "17.7.2" }, { "product": "Cisco IOS XE Software", "range": "17.10.1" }, { "product": "Cisco IOS XE Software", "range": "17.10.1a" }, { "product": "Cisco IOS XE Software", "range": "17.10.1b" }, { "product": "Cisco IOS XE Software", "range": "17.8.1" }, { "product": "Cisco IOS XE Software", "range": "17.8.1a" }, { "product": "Cisco IOS XE Software", "range": "17.9.1" }, { "product": "Cisco IOS XE Software", "range": "17.9.1w" }, { "product": "Cisco IOS XE Software", "range": "17.9.2" }, { "product": "Cisco IOS XE Software", "range": "17.9.1a" }, { "product": "Cisco IOS XE Software", "range": "17.9.1x" }, { "product": "Cisco IOS XE Software", "range": "17.9.1y" }, { "product": "Cisco IOS XE Software", "range": "17.9.3" }, { "product": "Cisco IOS XE Software", "range": "17.9.2a" }, { "product": "Cisco IOS XE Software", "range": "17.9.1x1" }, { "product": "Cisco IOS XE Software", "range": "17.9.3a" }, { "product": "Cisco IOS XE Software", "range": "17.9.1y1" }, { "product": "Cisco IOS XE Software", "range": "17.11.1" }, { "product": "Cisco IOS XE Software", "range": "17.11.1a" }, { "product": "Cisco IOS XE Software", "range": "17.11.99SW" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-20109", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20109", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-09-27T17:23:21.589Z", "modifiedAt": "2025-10-21T23:05:36.370Z", "fetchedAt": "2026-10-24T05:26:38.319Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.\r\n\r This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details [\"#details\"] section of this advisory.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "IOS", "versions": [ { "version": "12.4(24)T", "status": "affected" }, { "version": "12.4(24)T3", "status": "affected" }, { "version": "12.4(22)T1", "status": "affected" }, { "version": "12.4(24)T5", "status": "affected" }, { "version": "12.4(24)T4", "status": "affected" }, { "version": "12.4(22)T", "status": "affected" }, { "version": "12.4(24)T8", "status": "affected" }, { "version": "12.4(24)T2", "status": "affected" }, { "version": "12.4(22)T5", "status": "affected" }, { "version": "12.4(22)T4", "status": "affected" }, { "version": "12.4(24)T1", "status": "affected" }, { "version": "12.4(24)T7", "status": "affected" }, { "version": "12.4(22)T3", "status": "affected" }, { "version": "12.4(24)T6", "status": "affected" }, { "version": "12.4(22)T2", "status": "affected" }, { "version": "12.4(24)T4a", "status": "affected" }, { "version": "12.4(24)T4b", "status": "affected" }, { "version": "12.4(24)T3e", "status": "affected" }, { "version": "12.4(24)T4c", "status": "affected" }, { "version": "12.4(24)T4d", "status": "affected" }, { "version": "12.4(24)T4e", "status": "affected" }, { "version": "12.4(24)T3f", "status": "affected" }, { "version": "12.4(24)T4f", "status": "affected" }, { "version": "12.4(24)T4l", "status": "affected" }, { "version": "12.4(24)MD1", "status": "affected" }, { "version": "12.4(24)MD", "status": "affected" }, { "version": "12.4(24)MD3", "status": "affected" }, { "version": "12.4(24)MD2", "status": "affected" }, { "version": "12.4(22)MD1", "status": "affected" }, { "version": "12.4(22)MD2", "status": "affected" }, { "version": "12.4(24)MD5", "status": "affected" }, { "version": "12.4(22)MD", "status": "affected" }, { "version": "12.4(24)MD4", "status": "affected" }, { "version": "12.4(24)MD6", "status": "affected" }, { "version": "12.4(24)MD7", "status": "affected" }, { "version": "12.4(22)XR5", "status": "affected" }, { "version": "12.4(22)XR4", "status": "affected" }, { "version": "12.4(22)XR7", "status": "affected" }, { "version": "12.4(22)XR2", "status": "affected" }, { "version": "12.4(22)XR6", "status": "affected" }, { "version": "12.4(22)XR10", "status": "affected" }, { "version": "12.4(22)XR1", "status": "affected" }, { "version": "12.4(22)XR9", "status": "affected" }, { "version": "12.4(22)XR3", "status": "affected" }, { "version": "12.4(22)XR8", "status": "affected" }, { "version": "12.4(22)XR11", "status": "affected" }, { "version": "12.4(22)XR12", "status": "affected" }, { "version": "12.4(22)MDA3", "status": "affected" }, { "version": "12.4(24)MDA5", "status": "affected" }, { "version": "12.4(22)MDA5", "status": "affected" }, { "version": "12.4(24)MDA3", "status": "affected" }, { "version": "12.4(22)MDA4", "status": "affected" }, { "version": "12.4(24)MDA4", "status": "affected" }, { "version": "12.4(24)MDA1", "status": "affected" }, { "version": "12.4(22)MDA", "status": "affected" }, { "version": "12.4(22)MDA2", "status": "affected" }, { "version": "12.4(22)MDA1", "status": "affected" }, { "version": "12.4(24)MDA2", "status": "affected" }, { "version": "12.4(22)MDA6", "status": "affected" }, { "version": "12.4(24)MDA6", "status": "affected" }, { "version": "12.4(24)MDA7", "status": "affected" }, { "version": "12.4(24)MDA8", "status": "affected" }, { "version": "12.4(24)MDA10", "status": "affected" }, { "version": "12.4(24)MDA9", "status": "affected" }, { "version": "12.4(24)MDA11", "status": "affected" }, { "version": "12.4(24)MDA12", "status": "affected" }, { "version": "12.4(24)MDA13", "status": "affected" }, { "version": "12.4(24)YG3", "status": "affected" }, { "version": "12.4(24)YG4", "status": "affected" }, { "version": "12.4(24)YG1", "status": "affected" }, { "version": "12.4(24)YG2", "status": "affected" }, { "version": "12.4(24)YG", "status": "affected" }, { "version": "15.0(1)M1", "status": "affected" }, { "version": "15.0(1)M5", "status": "affected" }, { "version": "15.0(1)M4", "status": "affected" }, { "version": "15.0(1)M3", "status": "affected" }, { "version": "15.0(1)M2", "status": "affected" }, { "version": "15.0(1)M6", "status": "affected" }, { "version": "15.0(1)M", "status": "affected" }, { "version": "15.0(1)M7", "status": "affected" }, { "version": "15.0(1)M10", "status": "affected" }, { "version": "15.0(1)M9", "status": "affected" }, { "version": "15.0(1)M8", "status": "affected" }, { "version": "15.0(1)XA2", "status": "affected" }, { "version": "15.0(1)XA4", "status": "affected" }, { "version": "15.0(1)XA1", "status": "affected" }, { "version": "15.0(1)XA3", "status": "affected" }, { "version": "15.0(1)XA", "status": "affected" }, { "version": "15.0(1)XA5", "status": "affected" }, { "version": "15.1(2)T", "status": "affected" }, { "version": "15.1(1)T4", "status": "affected" }, { "version": "15.1(3)T2", "status": "affected" }, { "version": "15.1(1)T1", "status": "affected" }, { "version": "15.1(2)T0a", "status": "affected" }, { "version": "15.1(3)T3", "status": "affected" }, { "version": "15.1(1)T3", "status": "affected" }, { "version": "15.1(2)T3", "status": "affected" }, { "version": "15.1(2)T4", "status": "affected" }, { "version": "15.1(1)T2", "status": "affected" }, { "version": "15.1(3)T", "status": "affected" }, { "version": "15.1(2)T2a", "status": "affected" }, { "version": "15.1(3)T1", "status": "affected" }, { "version": "15.1(1)T", "status": "affected" }, { "version": "15.1(2)T2", "status": "affected" }, { "version": "15.1(2)T1", "status": "affected" }, { "version": "15.1(2)T5", "status": "affected" }, { "version": "15.1(3)T4", "status": "affected" }, { "version": "15.1(1)T5", "status": "affected" }, { "version": "15.1(1)XB", "status": "affected" }, { "version": "15.0(1)S2", "status": "affected" }, { "version": "15.0(1)S1", "status": "affected" }, { "version": "15.0(1)S", "status": "affected" }, { "version": "15.0(1)S3a", "status": "affected" }, { "version": "15.0(1)S4", "status": "affected" }, { "version": "15.0(1)S5", "status": "affected" }, { "version": "15.0(1)S4a", "status": "affected" }, { "version": "15.0(1)S6", "status": "affected" }, { "version": "15.2(1)S", "status": "affected" }, { "version": "15.2(2)S", "status": "affected" }, { "version": "15.2(1)S1", "status": "affected" }, { "version": "15.2(4)S", "status": "affected" }, { "version": "15.2(1)S2", "status": "affected" }, { "version": "15.2(2)S1", "status": "affected" }, { "version": "15.2(2)S2", "status": "affected" }, { "version": "15.2(2)S0a", "status": "affected" }, { "version": "15.2(2)S0c", "status": "affected" }, { "version": "15.2(4)S1", "status": "affected" }, { "version": "15.2(4)S4", "status": "affected" }, { "version": "15.2(4)S6", "status": "affected" }, { "version": "15.2(4)S2", "status": "affected" }, { "version": "15.2(4)S5", "status": "affected" }, { "version": "15.2(4)S3", "status": "affected" }, { "version": "15.2(4)S3a", "status": "affected" }, { "version": "15.2(4)S4a", "status": "affected" }, { "version": "15.2(4)S7", "status": "affected" }, { "version": "15.3(1)T", "status": "affected" }, { "version": "15.3(2)T", "status": "affected" }, { "version": "15.3(1)T1", "status": "affected" }, { "version": "15.3(1)T2", "status": "affected" }, { "version": "15.3(1)T3", "status": "affected" }, { "version": "15.3(1)T4", "status": "affected" }, { "version": "15.3(2)T1", "status": "affected" }, { "version": "15.3(2)T2", "status": "affected" }, { "version": "15.3(2)T3", "status": "affected" }, { "version": "15.3(2)T4", "status": "affected" }, { "version": "15.0(2)EY", "status": "affected" }, { "version": "15.0(2)EY1", "status": "affected" }, { "version": "15.0(2)EY2", "status": "affected" }, { "version": "15.0(2)EY3", "status": "affected" }, { "version": "15.1(2)S", "status": "affected" }, { "version": "15.1(1)S", "status": "affected" }, { "version": "15.1(1)S1", "status": "affected" }, { "version": "15.1(3)S", "status": "affected" }, { "version": "15.1(1)S2", "status": "affected" }, { "version": "15.1(2)S1", "status": "affected" }, { "version": "15.1(2)S2", "status": "affected" }, { "version": "15.1(3)S1", "status": "affected" }, { "version": "15.1(3)S0a", "status": "affected" }, { "version": "15.1(3)S2", "status": "affected" }, { "version": "15.1(3)S4", "status": "affected" }, { "version": "15.1(3)S3", "status": "affected" }, { "version": "15.1(3)S5", "status": "affected" }, { "version": "15.1(3)S6", "status": "affected" }, { "version": "15.1(3)S5a", "status": "affected" }, { "version": "15.1(4)M3", "status": "affected" }, { "version": "15.1(4)M", "status": "affected" }, { "version": "15.1(4)M1", "status": "affected" }, { "version": "15.1(4)M2", "status": "affected" }, { "version": "15.1(4)M6", "status": "affected" }, { "version": "15.1(4)M5", "status": "affected" }, { "version": "15.1(4)M4", "status": "affected" }, { "version": "15.1(4)M7", "status": "affected" }, { "version": "15.1(4)M3a", "status": "affected" }, { "version": "15.1(4)M10", "status": "affected" }, { "version": "15.1(4)M8", "status": "affected" }, { "version": "15.1(4)M9", "status": "affected" }, { "version": "15.0(2)SE", "status": "affected" }, { "version": "15.0(2)SE1", "status": "affected" }, { "version": "15.0(2)SE2", "status": "affected" }, { "version": "15.0(2)SE3", "status": "affected" }, { "version": "15.0(2)SE4", "status": "affected" }, { "version": "15.0(2)SE5", "status": "affected" }, { "version": "15.0(2)SE6", "status": "affected" }, { "version": "15.0(2)SE7", "status": "affected" }, { "version": "15.0(2)SE8", "status": "affected" }, { "version": "15.0(2)SE9", "status": "affected" }, { "version": "15.0(2)SE10", "status": "affected" }, { "version": "15.0(2)SE11", "status": "affected" }, { "version": "15.0(2)SE10a", "status": "affected" }, { "version": "15.0(2)SE12", "status": "affected" }, { "version": "15.0(2)SE13", "status": "affected" }, { "version": "15.1(2)GC", "status": "affected" }, { "version": "15.1(2)GC1", "status": "affected" }, { "version": "15.1(2)GC2", "status": "affected" }, { "version": "15.1(4)GC", "status": "affected" }, { "version": "15.1(4)GC1", "status": "affected" }, { "version": "15.1(4)GC2", "status": "affected" }, { "version": "15.1(1)SG", "status": "affected" }, { "version": "15.1(2)SG", "status": "affected" }, { "version": "15.1(1)SG1", "status": "affected" }, { "version": "15.1(1)SG2", "status": "affected" }, { "version": "15.1(2)SG1", "status": "affected" }, { "version": "15.1(2)SG2", "status": "affected" }, { "version": "15.1(2)SG3", "status": "affected" }, { "version": "15.1(2)SG4", "status": "affected" }, { "version": "15.1(2)SG5", "status": "affected" }, { "version": "15.1(2)SG6", "status": "affected" }, { "version": "15.1(2)SG7", "status": "affected" }, { "version": "15.1(2)SG8", "status": "affected" }, { "version": "15.0(1)MR", "status": "affected" }, { "version": "15.0(2)MR", "status": "affected" }, { "version": "15.2(4)M", "status": "affected" }, { "version": "15.2(4)M1", "status": "affected" }, { "version": "15.2(4)M2", "status": "affected" }, { "version": "15.2(4)M4", "status": "affected" }, { "version": "15.2(4)M3", "status": "affected" }, { "version": "15.2(4)M5", "status": "affected" }, { "version": "15.2(4)M8", "status": "affected" }, { "version": "15.2(4)M10", "status": "affected" }, { "version": "15.2(4)M7", "status": "affected" }, { "version": "15.2(4)M6", "status": "affected" }, { "version": "15.2(4)M9", "status": "affected" }, { "version": "15.2(4)M6a", "status": "affected" }, { "version": "15.2(4)M11", "status": "affected" }, { "version": "12.4(24)MDB", "status": "affected" }, { "version": "12.4(24)MDB1", "status": "affected" }, { "version": "12.4(24)MDB3", "status": "affected" }, { "version": "12.4(24)MDB4", "status": "affected" }, { "version": "12.4(24)MDB5", "status": "affected" }, { "version": "12.4(24)MDB6", "status": "affected" }, { "version": "12.4(24)MDB7", "status": "affected" }, { "version": "12.4(24)MDB5a", "status": "affected" }, { "version": "12.4(24)MDB8", "status": "affected" }, { "version": "12.4(24)MDB9", "status": "affected" }, { "version": "12.4(24)MDB10", "status": "affected" }, { "version": "12.4(24)MDB11", "status": "affected" }, { "version": "12.4(24)MDB12", "status": "affected" }, { "version": "12.4(24)MDB13", "status": "affected" }, { "version": "12.4(24)MDB14", "status": "affected" }, { "version": "12.4(24)MDB15", "status": "affected" }, { "version": "12.4(24)MDB16", "status": "affected" }, { "version": "12.4(24)MDB17", "status": "affected" }, { "version": "12.4(24)MDB18", "status": "affected" }, { "version": "12.4(24)MDB19", "status": "affected" }, { "version": "15.0(2)EX", "status": "affected" }, { "version": "15.0(2)EX1", "status": "affected" }, { "version": "15.0(2)EX2", "status": "affected" }, { "version": "15.0(2)EX3", "status": "affected" }, { "version": "15.0(2)EX4", "status": "affected" }, { "version": "15.0(2)EX5", "status": "affected" }, { "version": "15.0(2)EX8", "status": "affected" }, { "version": "15.0(2a)EX5", "status": "affected" }, { "version": "15.0(2)EX10", "status": "affected" }, { "version": "15.0(2)EX11", "status": "affected" }, { "version": "15.0(2)EX13", "status": "affected" }, { "version": "15.0(2)EX12", "status": "affected" }, { "version": "15.2(1)GC", "status": "affected" }, { "version": "15.2(1)GC1", "status": "affected" }, { "version": "15.2(1)GC2", "status": "affected" }, { "version": "15.2(2)GC", "status": "affected" }, { "version": "15.2(3)GC", "status": "affected" }, { "version": "15.2(3)GC1", "status": "affected" }, { "version": "15.2(4)GC", "status": "affected" }, { "version": "15.2(4)GC1", "status": "affected" }, { "version": "15.2(4)GC2", "status": "affected" }, { "version": "15.2(4)GC3", "status": "affected" }, { "version": "15.1(1)SY", "status": "affected" }, { "version": "15.1(1)SY1", "status": "affected" }, { "version": "15.1(2)SY", "status": "affected" }, { "version": "15.1(2)SY1", "status": "affected" }, { "version": "15.1(2)SY2", "status": "affected" }, { "version": "15.1(1)SY2", "status": "affected" }, { "version": "15.1(1)SY3", "status": "affected" }, { "version": "15.1(2)SY3", "status": "affected" }, { "version": "15.1(1)SY4", "status": "affected" }, { "version": "15.1(2)SY4", "status": "affected" }, { "version": "15.1(1)SY5", "status": "affected" }, { "version": "15.1(2)SY5", "status": "affected" }, { "version": "15.1(2)SY4a", "status": "affected" }, { "version": "15.1(1)SY6", "status": "affected" }, { "version": "15.1(2)SY6", "status": "affected" }, { "version": "15.1(2)SY7", "status": "affected" }, { "version": "15.1(2)SY8", "status": "affected" }, { "version": "15.1(2)SY9", "status": "affected" }, { "version": "15.1(2)SY10", "status": "affected" }, { "version": "15.1(2)SY11", "status": "affected" }, { "version": "15.1(2)SY12", "status": "affected" }, { "version": "15.1(2)SY13", "status": "affected" }, { "version": "15.1(2)SY14", "status": "affected" }, { "version": "15.1(2)SY15", "status": "affected" }, { "version": "15.1(2)SY16", "status": "affected" }, { "version": "15.3(1)S", "status": "affected" }, { "version": "15.3(2)S", "status": "affected" }, { "version": "15.3(3)S", "status": "affected" }, { "version": "15.3(1)S2", "status": "affected" }, { "version": "15.3(1)S1", "status": "affected" }, { "version": "15.3(2)S2", "status": "affected" }, { "version": "15.3(2)S1", "status": "affected" }, { "version": "15.3(3)S1", "status": "affected" }, { "version": "15.3(3)S2", "status": "affected" }, { "version": "15.3(3)S3", "status": "affected" }, { "version": "15.3(3)S6", "status": "affected" }, { "version": "15.3(3)S4", "status": "affected" }, { "version": "15.3(3)S1a", "status": "affected" }, { "version": "15.3(3)S5", "status": "affected" }, { "version": "15.3(3)S7", "status": "affected" }, { "version": "15.3(3)S8", "status": "affected" }, { "version": "15.3(3)S9", "status": "affected" }, { "version": "15.3(3)S10", "status": "affected" }, { "version": "15.3(3)S8a", "status": "affected" }, { "version": "15.4(1)T", "status": "affected" }, { "version": "15.4(2)T", "status": "affected" }, { "version": "15.4(1)T2", "status": "affected" }, { "version": "15.4(1)T1", "status": "affected" }, { "version": "15.4(1)T3", "status": "affected" }, { "version": "15.4(2)T1", "status": "affected" }, { "version": "15.4(2)T3", "status": "affected" }, { "version": "15.4(2)T2", "status": "affected" }, { "version": "15.4(1)T4", "status": "affected" }, { "version": "15.4(2)T4", "status": "affected" }, { "version": "15.0(2)EA", "status": "affected" }, { "version": "15.0(2)EA1", "status": "affected" }, { "version": "15.2(1)E", "status": "affected" }, { "version": "15.2(2)E", "status": "affected" }, { "version": "15.2(1)E1", "status": "affected" }, { "version": "15.2(3)E", "status": "affected" }, { "version": "15.2(1)E2", "status": "affected" }, { "version": "15.2(1)E3", "status": "affected" }, { "version": "15.2(2)E1", "status": "affected" }, { "version": "15.2(4)E", "status": "affected" }, { "version": "15.2(3)E1", "status": "affected" }, { "version": "15.2(2)E2", "status": "affected" }, { "version": "15.2(2a)E1", "status": "affected" }, { "version": "15.2(2)E3", "status": "affected" }, { "version": "15.2(2a)E2", "status": "affected" }, { "version": "15.2(3)E2", "status": "affected" }, { "version": "15.2(3a)E", "status": "affected" }, { "version": "15.2(3)E3", "status": "affected" }, { "version": "15.2(4)E1", "status": "affected" }, { "version": "15.2(2)E4", "status": "affected" }, { "version": "15.2(2)E5", "status": "affected" }, { "version": "15.2(4)E2", "status": "affected" }, { "version": "15.2(3)E4", "status": "affected" }, { "version": "15.2(5)E", "status": "affected" }, { "version": "15.2(4)E3", "status": "affected" }, { "version": "15.2(2)E6", "status": "affected" }, { "version": "15.2(5a)E", "status": "affected" }, { "version": "15.2(5)E1", "status": "affected" }, { "version": "15.2(5b)E", "status": "affected" }, { "version": "15.2(2)E5a", "status": "affected" }, { "version": "15.2(5c)E", "status": "affected" }, { "version": "15.2(3)E5", "status": "affected" }, { "version": "15.2(2)E5b", "status": "affected" }, { "version": "15.2(5a)E1", "status": "affected" }, { "version": "15.2(4)E4", "status": "affected" }, { "version": "15.2(2)E7", "status": "affected" }, { "version": "15.2(5)E2", "status": "affected" }, { "version": "15.2(6)E", "status": "affected" }, { "version": "15.2(5)E2b", "status": "affected" }, { "version": "15.2(4)E5", "status": "affected" }, { "version": "15.2(5)E2c", "status": "affected" }, { "version": "15.2(2)E8", "status": "affected" }, { "version": "15.2(6)E0a", "status": "affected" }, { "version": "15.2(6)E1", "status": "affected" }, { "version": "15.2(2)E7b", "status": "affected" }, { "version": "15.2(4)E5a", "status": "affected" }, { "version": "15.2(6)E0c", "status": "affected" }, { "version": "15.2(4)E6", "status": "affected" }, { "version": "15.2(6)E2", "status": "affected" }, { "version": "15.2(2)E9", "status": "affected" }, { "version": "15.2(4)E7", "status": "affected" }, { "version": "15.2(7)E", "status": "affected" }, { "version": "15.2(2)E10", "status": "affected" }, { "version": "15.2(4)E8", "status": "affected" }, { "version": "15.2(6)E2a", "status": "affected" }, { "version": "15.2(6)E2b", "status": "affected" }, { "version": "15.2(7)E1", "status": "affected" }, { "version": "15.2(7)E0a", "status": "affected" }, { "version": "15.2(7)E0b", "status": "affected" }, { "version": "15.2(7)E0s", "status": "affected" }, { "version": "15.2(6)E3", "status": "affected" }, { "version": "15.2(4)E9", "status": "affected" }, { "version": "15.2(7)E2", "status": "affected" }, { "version": "15.2(7a)E0b", "status": "affected" }, { "version": "15.2(4)E10", "status": "affected" }, { "version": "15.2(7)E3", "status": "affected" }, { "version": "15.2(7)E1a", "status": "affected" }, { "version": "15.2(7b)E0b", "status": "affected" }, { "version": "15.2(7)E2a", "status": "affected" }, { "version": "15.2(4)E10a", "status": "affected" }, { "version": "15.2(7)E4", "status": "affected" }, { "version": "15.2(7)E3k", "status": "affected" }, { "version": "15.2(8)E", "status": "affected" }, { "version": "15.2(8)E1", "status": "affected" }, { "version": "15.2(7)E5", "status": "affected" }, { "version": "15.2(7)E6", "status": "affected" }, { "version": "15.2(8)E2", "status": "affected" }, { "version": "15.2(4)E10d", "status": "affected" }, { "version": "15.2(7)E7", "status": "affected" }, { "version": "15.2(8)E3", "status": "affected" }, { "version": "15.2(7)E8", "status": "affected" }, { "version": "15.2(8)E4", "status": "affected" }, { "version": "15.1(3)MRA", "status": "affected" }, { "version": "15.1(3)MRA1", "status": "affected" }, { "version": "15.1(3)MRA2", "status": "affected" }, { "version": "15.1(3)MRA3", "status": "affected" }, { "version": "15.1(3)MRA4", "status": "affected" }, { "version": "15.1(3)SVB1", "status": "affected" }, { "version": "15.1(3)SVB2", "status": "affected" }, { "version": "15.4(1)S", "status": "affected" }, { "version": "15.4(2)S", "status": "affected" }, { "version": "15.4(3)S", "status": "affected" }, { "version": "15.4(1)S1", "status": "affected" }, { "version": "15.4(1)S2", "status": "affected" }, { "version": "15.4(2)S1", "status": "affected" }, { "version": "15.4(1)S3", "status": "affected" }, { "version": "15.4(3)S1", "status": "affected" }, { "version": "15.4(2)S2", "status": "affected" }, { "version": "15.4(3)S2", "status": "affected" }, { "version": "15.4(3)S3", "status": "affected" }, { "version": "15.4(1)S4", "status": "affected" }, { "version": "15.4(2)S3", "status": "affected" }, { "version": "15.4(2)S4", "status": "affected" }, { "version": "15.4(3)S4", "status": "affected" }, { "version": "15.4(3)S5", "status": "affected" }, { "version": "15.4(3)S6", "status": "affected" }, { "version": "15.4(3)S7", "status": "affected" }, { "version": "15.4(3)S6a", "status": "affected" }, { "version": "15.4(3)S8", "status": "affected" }, { "version": "15.4(3)S9", "status": "affected" }, { "version": "15.4(3)S10", "status": "affected" }, { "version": "15.3(3)M", "status": "affected" }, { "version": "15.3(3)M1", "status": "affected" }, { "version": "15.3(3)M2", "status": "affected" }, { "version": "15.3(3)M3", "status": "affected" }, { "version": "15.3(3)M5", "status": "affected" }, { "version": "15.3(3)M4", "status": "affected" }, { "version": "15.3(3)M6", "status": "affected" }, { "version": "15.3(3)M7", "status": "affected" }, { "version": "15.3(3)M8", "status": "affected" }, { "version": "15.3(3)M9", "status": "affected" }, { "version": "15.3(3)M10", "status": "affected" }, { "version": "15.3(3)M8a", "status": "affected" }, { "version": "15.0(2)EZ", "status": "affected" }, { "version": "15.1(3)SVD", "status": "affected" }, { "version": "15.1(3)SVD1", "status": "affected" }, { "version": "15.1(3)SVD2", "status": "affected" }, { "version": "15.2(1)EY", "status": "affected" }, { "version": "15.0(2)EJ", "status": "affected" }, { "version": "15.0(2)EJ1", "status": "affected" }, { "version": "15.2(1)SY", "status": "affected" }, { "version": "15.2(1)SY1", "status": "affected" }, { "version": "15.2(1)SY0a", "status": "affected" }, { "version": "15.2(1)SY2", "status": "affected" }, { "version": "15.2(2)SY", "status": "affected" }, { "version": "15.2(1)SY1a", "status": "affected" }, { "version": "15.2(2)SY1", "status": "affected" }, { "version": "15.2(2)SY2", "status": "affected" }, { "version": "15.2(1)SY3", "status": "affected" }, { "version": "15.2(1)SY4", "status": "affected" }, { "version": "15.2(2)SY3", "status": "affected" }, { "version": "15.2(1)SY5", "status": "affected" }, { "version": "15.2(1)SY6", "status": "affected" }, { "version": "15.2(1)SY7", "status": "affected" }, { "version": "15.2(1)SY8", "status": "affected" }, { "version": "15.2(5)EX", "status": "affected" }, { "version": "15.1(3)SVF", "status": "affected" }, { "version": "15.1(3)SVF1", "status": "affected" }, { "version": "15.1(3)SVE", "status": "affected" }, { "version": "15.4(3)M", "status": "affected" }, { "version": "15.4(3)M1", "status": "affected" }, { "version": "15.4(3)M2", "status": "affected" }, { "version": "15.4(3)M3", "status": "affected" }, { "version": "15.4(3)M4", "status": "affected" }, { "version": "15.4(3)M5", "status": "affected" }, { "version": "15.4(3)M6", "status": "affected" }, { "version": "15.4(3)M7", "status": "affected" }, { "version": "15.4(3)M6a", "status": "affected" }, { "version": "15.4(3)M8", "status": "affected" }, { "version": "15.4(3)M9", "status": "affected" }, { "version": "15.4(3)M10", "status": "affected" }, { "version": "15.0(2)EK", "status": "affected" }, { "version": "15.0(2)EK1", "status": "affected" }, { "version": "15.4(1)CG", "status": "affected" }, { "version": "15.4(1)CG1", "status": "affected" }, { "version": "15.4(2)CG", "status": "affected" }, { "version": "15.5(1)S", "status": "affected" }, { "version": "15.5(2)S", "status": "affected" }, { "version": "15.5(1)S1", "status": "affected" }, { "version": "15.5(3)S", "status": "affected" }, { "version": "15.5(1)S2", "status": "affected" }, { "version": "15.5(1)S3", "status": "affected" }, { "version": "15.5(2)S1", "status": "affected" }, { "version": "15.5(2)S2", "status": "affected" }, { "version": "15.5(3)S1", "status": "affected" }, { "version": "15.5(3)S1a", "status": "affected" }, { "version": "15.5(2)S3", "status": "affected" }, { "version": "15.5(3)S2", "status": "affected" }, { "version": "15.5(3)S0a", "status": "affected" }, { "version": "15.5(3)S3", "status": "affected" }, { "version": "15.5(1)S4", "status": "affected" }, { "version": "15.5(2)S4", "status": "affected" }, { "version": "15.5(3)S4", "status": "affected" }, { "version": "15.5(3)S5", "status": "affected" }, { "version": "15.5(3)S6", "status": "affected" }, { "version": "15.5(3)S6a", "status": "affected" }, { "version": "15.5(3)S7", "status": "affected" }, { "version": "15.5(3)S6b", "status": "affected" }, { "version": "15.5(3)S8", "status": "affected" }, { "version": "15.5(3)S9", "status": "affected" }, { "version": "15.5(3)S10", "status": "affected" }, { "version": "15.5(3)S9a", "status": "affected" }, { "version": "15.1(3)SVG", "status": "affected" }, { "version": "15.2(2)EB", "status": "affected" }, { "version": "15.2(2)EB1", "status": "affected" }, { "version": "15.2(2)EB2", "status": "affected" }, { "version": "15.2(6)EB", "status": "affected" }, { "version": "15.5(1)T", "status": "affected" }, { "version": "15.5(1)T1", "status": "affected" }, { "version": "15.5(2)T", "status": "affected" }, { "version": "15.5(1)T2", "status": "affected" }, { "version": "15.5(1)T3", "status": "affected" }, { "version": "15.5(2)T1", "status": "affected" }, { "version": "15.5(2)T2", "status": "affected" }, { "version": "15.5(2)T3", "status": "affected" }, { "version": "15.5(2)T4", "status": "affected" }, { "version": "15.5(1)T4", "status": "affected" }, { "version": "15.2(2)EA", "status": "affected" }, { "version": "15.2(2)EA1", "status": "affected" }, { "version": "15.2(2)EA2", "status": "affected" }, { "version": "15.2(3)EA", "status": "affected" }, { "version": "15.2(4)EA", "status": "affected" }, { "version": "15.2(4)EA1", "status": "affected" }, { "version": "15.2(2)EA3", "status": "affected" }, { "version": "15.2(4)EA3", "status": "affected" }, { "version": "15.2(5)EA", "status": "affected" }, { "version": "15.2(4)EA4", "status": "affected" }, { "version": "15.2(4)EA5", "status": "affected" }, { "version": "15.2(4)EA6", "status": "affected" }, { "version": "15.2(4)EA7", "status": "affected" }, { "version": "15.2(4)EA8", "status": "affected" }, { "version": "15.2(4)EA9", "status": "affected" }, { "version": "15.2(4)EA9a", "status": "affected" }, { "version": "15.5(3)M", "status": "affected" }, { "version": "15.5(3)M1", "status": "affected" }, { "version": "15.5(3)M0a", "status": "affected" }, { "version": "15.5(3)M2", "status": "affected" }, { "version": "15.5(3)M3", "status": "affected" }, { "version": "15.5(3)M4", "status": "affected" }, { "version": "15.5(3)M4a", "status": "affected" }, { "version": "15.5(3)M5", "status": "affected" }, { "version": "15.5(3)M6", "status": "affected" }, { "version": "15.5(3)M7", "status": "affected" }, { "version": "15.5(3)M6a", "status": "affected" }, { "version": "15.5(3)M8", "status": "affected" }, { "version": "15.5(3)M9", "status": "affected" }, { "version": "15.5(3)M10", "status": "affected" }, { "version": "15.5(3)SN", "status": "affected" }, { "version": "15.6(1)S", "status": "affected" }, { "version": "15.6(2)S", "status": "affected" }, { "version": "15.6(2)S1", "status": "affected" }, { "version": "15.6(1)S1", "status": "affected" }, { "version": "15.6(1)S2", "status": "affected" }, { "version": "15.6(2)S2", "status": "affected" }, { "version": "15.6(1)S3", "status": "affected" }, { "version": "15.6(2)S3", "status": "affected" }, { "version": "15.6(1)S4", "status": "affected" }, { "version": "15.6(2)S4", "status": "affected" }, { "version": "15.6(1)T", "status": "affected" }, { "version": "15.6(2)T", "status": "affected" }, { "version": "15.6(1)T0a", "status": "affected" }, { "version": "15.6(1)T1", "status": "affected" }, { "version": "15.6(2)T1", "status": "affected" }, { "version": "15.6(1)T2", "status": "affected" }, { "version": "15.6(2)T2", "status": "affected" }, { "version": "15.6(1)T3", "status": "affected" }, { "version": "15.6(2)T3", "status": "affected" }, { "version": "15.3(1)SY", "status": "affected" }, { "version": "15.3(1)SY1", "status": "affected" }, { "version": "15.3(1)SY2", "status": "affected" }, { "version": "15.6(2)SP", "status": "affected" }, { "version": "15.6(2)SP1", "status": "affected" }, { "version": "15.6(2)SP2", "status": "affected" }, { "version": "15.6(2)SP3", "status": "affected" }, { "version": "15.6(2)SP4", "status": "affected" }, { "version": "15.6(2)SP5", "status": "affected" }, { "version": "15.6(2)SP6", "status": "affected" }, { "version": "15.6(2)SP7", "status": "affected" }, { "version": "15.6(2)SP8", "status": "affected" }, { "version": "15.6(2)SP9", "status": "affected" }, { "version": "15.6(2)SP10", "status": "affected" }, { "version": "15.6(2)SN", "status": "affected" }, { "version": "15.6(3)M", "status": "affected" }, { "version": "15.6(3)M1", "status": "affected" }, { "version": "15.6(3)M0a", "status": "affected" }, { "version": "15.6(3)M1b", "status": "affected" }, { "version": "15.6(3)M2", "status": "affected" }, { "version": "15.6(3)M2a", "status": "affected" }, { "version": "15.6(3)M3", "status": "affected" }, { "version": "15.6(3)M3a", "status": "affected" }, { "version": "15.6(3)M4", "status": "affected" }, { "version": "15.6(3)M5", "status": "affected" }, { "version": "15.6(3)M6", "status": "affected" }, { "version": "15.6(3)M7", "status": "affected" }, { "version": "15.6(3)M6a", "status": "affected" }, { "version": "15.6(3)M6b", "status": "affected" }, { "version": "15.6(3)M8", "status": "affected" }, { "version": "15.6(3)M9", "status": "affected" }, { "version": "15.1(3)SVJ2", "status": "affected" }, { "version": "15.2(4)EC1", "status": "affected" }, { "version": "15.2(4)EC2", "status": "affected" }, { "version": "15.4(1)SY", "status": "affected" }, { "version": "15.4(1)SY1", "status": "affected" }, { "version": "15.4(1)SY2", "status": "affected" }, { "version": "15.4(1)SY3", "status": "affected" }, { "version": "15.4(1)SY4", "status": "affected" }, { "version": "15.5(1)SY", "status": "affected" }, { "version": "15.5(1)SY1", "status": "affected" }, { "version": "15.5(1)SY2", "status": "affected" }, { "version": "15.5(1)SY3", "status": "affected" }, { "version": "15.5(1)SY4", "status": "affected" }, { "version": "15.5(1)SY5", "status": "affected" }, { "version": "15.5(1)SY6", "status": "affected" }, { "version": "15.5(1)SY7", "status": "affected" }, { "version": "15.5(1)SY8", "status": "affected" }, { "version": "15.5(1)SY9", "status": "affected" }, { "version": "15.5(1)SY10", "status": "affected" }, { "version": "15.5(1)SY11", "status": "affected" }, { "version": "15.7(3)M", "status": "affected" }, { "version": "15.7(3)M1", "status": "affected" }, { "version": "15.7(3)M0a", "status": "affected" }, { "version": "15.7(3)M3", "status": "affected" }, { "version": "15.7(3)M2", "status": "affected" }, { "version": "15.7(3)M4", "status": "affected" }, { "version": "15.7(3)M5", "status": "affected" }, { "version": "15.7(3)M4a", "status": "affected" }, { "version": "15.7(3)M4b", "status": "affected" }, { "version": "15.7(3)M6", "status": "affected" }, { "version": "15.7(3)M7", "status": "affected" }, { "version": "15.7(3)M8", "status": "affected" }, { "version": "15.7(3)M9", "status": "affected" }, { "version": "15.8(3)M", "status": "affected" }, { "version": "15.8(3)M1", "status": "affected" }, { "version": "15.8(3)M0a", "status": "affected" }, { "version": "15.8(3)M0b", "status": "affected" }, { "version": "15.8(3)M2", "status": "affected" }, { "version": "15.8(3)M1a", "status": "affected" }, { "version": "15.8(3)M3", "status": "affected" }, { "version": "15.8(3)M2a", "status": "affected" }, { "version": "15.8(3)M4", "status": "affected" }, { "version": "15.8(3)M3a", "status": "affected" }, { "version": "15.8(3)M3b", "status": "affected" }, { "version": "15.8(3)M5", "status": "affected" }, { "version": "15.8(3)M6", "status": "affected" }, { "version": "15.8(3)M7", "status": "affected" }, { "version": "15.8(3)M8", "status": "affected" }, { "version": "15.8(3)M9", "status": "affected" }, { "version": "15.8(3)M10", "status": "affected" }, { "version": "15.9(3)M", "status": "affected" }, { "version": "15.9(3)M1", "status": "affected" }, { "version": "15.9(3)M0a", "status": "affected" }, { "version": "15.9(3)M2", "status": "affected" }, { "version": "15.9(3)M3", "status": "affected" }, { "version": "15.9(3)M2a", "status": "affected" }, { "version": "15.9(3)M3a", "status": "affected" }, { "version": "15.9(3)M4", "status": "affected" }, { "version": "15.9(3)M3b", "status": "affected" }, { "version": "15.9(3)M5", "status": "affected" }, { "version": "15.9(3)M4a", "status": "affected" }, { "version": "15.9(3)M6", "status": "affected" }, { "version": "15.9(3)M7", "status": "affected" }, { "version": "15.9(3)M6a", "status": "affected" }, { "version": "15.9(3)M6b", "status": "affected" }, { "version": "15.9(3)M7a", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [ { "version": "3.7.0S", "status": "affected" }, { "version": "3.7.1S", "status": "affected" }, { "version": "3.7.2S", "status": "affected" }, { "version": "3.7.3S", "status": "affected" }, { "version": "3.7.4S", "status": "affected" }, { "version": "3.7.5S", "status": "affected" }, { "version": "3.7.6S", "status": "affected" }, { "version": "3.7.7S", "status": "affected" }, { "version": "3.7.4aS", "status": "affected" }, { "version": "3.7.2tS", "status": "affected" }, { "version": "3.7.0bS", "status": "affected" }, { "version": "3.7.1aS", "status": "affected" }, { "version": "3.3.0SG", "status": "affected" }, { "version": "3.3.2SG", "status": "affected" }, { "version": "3.3.1SG", "status": "affected" }, { "version": "3.8.0S", "status": "affected" }, { "version": "3.8.1S", "status": "affected" }, { "version": "3.8.2S", "status": "affected" }, { "version": "3.9.1S", "status": "affected" }, { "version": "3.9.0S", "status": "affected" }, { "version": "3.9.2S", "status": "affected" }, { "version": "3.9.1aS", "status": "affected" }, { "version": "3.9.0aS", "status": "affected" }, { "version": "3.4.0SG", "status": "affected" }, { "version": "3.4.2SG", "status": "affected" }, { "version": "3.4.1SG", "status": "affected" }, { "version": "3.4.3SG", "status": "affected" }, { "version": "3.4.4SG", "status": "affected" }, { "version": "3.4.5SG", "status": "affected" }, { "version": "3.4.6SG", "status": "affected" }, { "version": "3.4.7SG", "status": "affected" }, { "version": "3.4.8SG", "status": "affected" }, { "version": "3.5.0E", "status": "affected" }, { "version": "3.5.1E", "status": "affected" }, { "version": "3.5.2E", "status": "affected" }, { "version": "3.5.3E", "status": "affected" }, { "version": "3.10.0S", "status": "affected" }, { "version": "3.10.1S", "status": "affected" }, { "version": "3.10.2S", "status": "affected" }, { "version": "3.10.3S", "status": "affected" }, { "version": "3.10.4S", "status": "affected" }, { "version": "3.10.5S", "status": "affected" }, { "version": "3.10.6S", "status": "affected" }, { "version": "3.10.2tS", "status": "affected" }, { "version": "3.10.7S", "status": "affected" }, { "version": "3.10.1xbS", "status": "affected" }, { "version": "3.10.8S", "status": "affected" }, { "version": "3.10.8aS", "status": "affected" }, { "version": "3.10.9S", "status": "affected" }, { "version": "3.10.10S", "status": "affected" }, { "version": "3.11.1S", "status": "affected" }, { "version": "3.11.2S", "status": "affected" }, { "version": "3.11.0S", "status": "affected" }, { "version": "3.11.3S", "status": "affected" }, { "version": "3.11.4S", "status": "affected" }, { "version": "3.12.0S", "status": "affected" }, { "version": "3.12.1S", "status": "affected" }, { "version": "3.12.2S", "status": "affected" }, { "version": "3.12.3S", "status": "affected" }, { "version": "3.12.0aS", "status": "affected" }, { "version": "3.12.4S", "status": "affected" }, { "version": "3.13.0S", "status": "affected" }, { "version": "3.13.1S", "status": "affected" }, { "version": "3.13.2S", "status": "affected" }, { "version": "3.13.3S", "status": "affected" }, { "version": "3.13.4S", "status": "affected" }, { "version": "3.13.5S", "status": "affected" }, { "version": "3.13.2aS", "status": "affected" }, { "version": "3.13.0aS", "status": "affected" }, { "version": "3.13.5aS", "status": "affected" }, { "version": "3.13.6S", "status": "affected" }, { "version": "3.13.7S", "status": "affected" }, { "version": "3.13.6aS", "status": "affected" }, { "version": "3.13.7aS", "status": "affected" }, { "version": "3.13.8S", "status": "affected" }, { "version": "3.13.9S", "status": "affected" }, { "version": "3.13.10S", "status": "affected" }, { "version": "3.6.0E", "status": "affected" }, { "version": "3.6.1E", "status": "affected" }, { "version": "3.6.2aE", "status": "affected" }, { "version": "3.6.2E", "status": "affected" }, { "version": "3.6.3E", "status": "affected" }, { "version": "3.6.4E", "status": "affected" }, { "version": "3.6.5E", "status": "affected" }, { "version": "3.6.6E", "status": "affected" }, { "version": "3.6.5aE", "status": "affected" }, { "version": "3.6.5bE", "status": "affected" }, { "version": "3.6.7E", "status": "affected" }, { "version": "3.6.8E", "status": "affected" }, { "version": "3.6.7bE", "status": "affected" }, { "version": "3.6.9E", "status": "affected" }, { "version": "3.6.10E", "status": "affected" }, { "version": "3.14.0S", "status": "affected" }, { "version": "3.14.1S", "status": "affected" }, { "version": "3.14.2S", "status": "affected" }, { "version": "3.14.3S", "status": "affected" }, { "version": "3.14.4S", "status": "affected" }, { "version": "3.15.0S", "status": "affected" }, { "version": "3.15.1S", "status": "affected" }, { "version": "3.15.2S", "status": "affected" }, { "version": "3.15.1cS", "status": "affected" }, { "version": "3.15.3S", "status": "affected" }, { "version": "3.15.4S", "status": "affected" }, { "version": "3.16.0S", "status": "affected" }, { "version": "3.16.1S", "status": "affected" }, { "version": "3.16.1aS", "status": "affected" }, { "version": "3.16.2S", "status": "affected" }, { "version": "3.16.2aS", "status": "affected" }, { "version": "3.16.0cS", "status": "affected" }, { "version": "3.16.3S", "status": "affected" }, { "version": "3.16.2bS", "status": "affected" }, { "version": "3.16.3aS", "status": "affected" }, { "version": "3.16.4S", "status": "affected" }, { "version": "3.16.4aS", "status": "affected" }, { "version": "3.16.4bS", "status": "affected" }, { "version": "3.16.5S", "status": "affected" }, { "version": "3.16.4dS", "status": "affected" }, { "version": "3.16.6S", "status": "affected" }, { "version": "3.16.7S", "status": "affected" }, { "version": "3.16.6bS", "status": "affected" }, { "version": "3.16.7aS", "status": "affected" }, { "version": "3.16.7bS", "status": "affected" }, { "version": "3.16.8S", "status": "affected" }, { "version": "3.16.9S", "status": "affected" }, { "version": "3.16.10S", "status": "affected" }, { "version": "3.17.0S", "status": "affected" }, { "version": "3.17.1S", "status": "affected" }, { "version": "3.17.2S", "status": "affected" }, { "version": "3.17.1aS", "status": "affected" }, { "version": "3.17.3S", "status": "affected" }, { "version": "3.17.4S", "status": "affected" }, { "version": "16.1.1", "status": "affected" }, { "version": "16.1.2", "status": "affected" }, { "version": "16.1.3", "status": "affected" }, { "version": "16.2.1", "status": "affected" }, { "version": "16.2.2", "status": "affected" }, { "version": "3.8.0E", "status": "affected" }, { "version": "3.8.1E", "status": "affected" }, { "version": "3.8.2E", "status": "affected" }, { "version": "3.8.3E", "status": "affected" }, { "version": "3.8.4E", "status": "affected" }, { "version": "3.8.5E", "status": "affected" }, { "version": "3.8.5aE", "status": "affected" }, { "version": "3.8.6E", "status": "affected" }, { "version": "3.8.7E", "status": "affected" }, { "version": "3.8.8E", "status": "affected" }, { "version": "3.8.9E", "status": "affected" }, { "version": "3.8.10E", "status": "affected" }, { "version": "16.3.1", "status": "affected" }, { "version": "16.3.2", "status": "affected" }, { "version": "16.3.3", "status": "affected" }, { "version": "16.3.1a", "status": "affected" }, { "version": "16.3.4", "status": "affected" }, { "version": "16.3.5", "status": "affected" }, { "version": "16.3.5b", "status": "affected" }, { "version": "16.3.6", "status": "affected" }, { "version": "16.3.7", "status": "affected" }, { "version": "16.3.8", "status": "affected" }, { "version": "16.3.9", "status": "affected" }, { "version": "16.3.10", "status": "affected" }, { "version": "16.3.11", "status": "affected" }, { "version": "16.4.1", "status": "affected" }, { "version": "16.4.2", "status": "affected" }, { "version": "16.4.3", "status": "affected" }, { "version": "16.5.1", "status": "affected" }, { "version": "16.5.1a", "status": "affected" }, { "version": "16.5.1b", "status": "affected" }, { "version": "16.5.2", "status": "affected" }, { "version": "16.5.3", "status": "affected" }, { "version": "3.18.0aS", "status": "affected" }, { "version": "3.18.0S", "status": "affected" }, { "version": "3.18.1S", "status": "affected" }, { "version": "3.18.2S", "status": "affected" }, { "version": "3.18.3S", "status": "affected" }, { "version": "3.18.4S", "status": "affected" }, { "version": "3.18.0SP", "status": "affected" }, { "version": "3.18.1SP", "status": "affected" }, { "version": "3.18.1aSP", "status": "affected" }, { "version": "3.18.1bSP", "status": "affected" }, { "version": "3.18.1cSP", "status": "affected" }, { "version": "3.18.2SP", "status": "affected" }, { "version": "3.18.2aSP", "status": "affected" }, { "version": "3.18.3SP", "status": "affected" }, { "version": "3.18.4SP", "status": "affected" }, { "version": "3.18.3aSP", "status": "affected" }, { "version": "3.18.3bSP", "status": "affected" }, { "version": "3.18.5SP", "status": "affected" }, { "version": "3.18.6SP", "status": "affected" }, { "version": "3.18.7SP", "status": "affected" }, { "version": "3.18.8aSP", "status": "affected" }, { "version": "3.18.9SP", "status": "affected" }, { "version": "3.9.0E", "status": "affected" }, { "version": "3.9.1E", "status": "affected" }, { "version": "3.9.2E", "status": "affected" }, { "version": "16.6.1", "status": "affected" }, { "version": "16.6.2", "status": "affected" }, { "version": "16.6.3", "status": "affected" }, { "version": "16.6.4", "status": "affected" }, { "version": "16.6.5", "status": "affected" }, { "version": "16.6.4a", "status": "affected" }, { "version": "16.6.5a", "status": "affected" }, { "version": "16.6.6", "status": "affected" }, { "version": "16.6.7", "status": "affected" }, { "version": "16.6.8", "status": "affected" }, { "version": "16.6.9", "status": "affected" }, { "version": "16.6.10", "status": "affected" }, { "version": "16.7.1", "status": "affected" }, { "version": "16.7.1a", "status": "affected" }, { "version": "16.7.1b", "status": "affected" }, { "version": "16.7.2", "status": "affected" }, { "version": "16.7.3", "status": "affected" }, { "version": "16.7.4", "status": "affected" }, { "version": "16.8.1", "status": "affected" }, { "version": "16.8.1a", "status": "affected" }, { "version": "16.8.1b", "status": "affected" }, { "version": "16.8.1s", "status": "affected" }, { "version": "16.8.1c", "status": "affected" }, { "version": "16.8.1d", "status": "affected" }, { "version": "16.8.2", "status": "affected" }, { "version": "16.8.1e", "status": "affected" }, { "version": "16.8.3", "status": "affected" }, { "version": "16.9.1", "status": "affected" }, { "version": "16.9.2", "status": "affected" }, { "version": "16.9.1a", "status": "affected" }, { "version": "16.9.1b", "status": "affected" }, { "version": "16.9.1s", "status": "affected" }, { "version": "16.9.3", "status": "affected" }, { "version": "16.9.4", "status": "affected" }, { "version": "16.9.3a", "status": "affected" }, { "version": "16.9.5", "status": "affected" }, { "version": "16.9.5f", "status": "affected" }, { "version": "16.9.6", "status": "affected" }, { "version": "16.9.7", "status": "affected" }, { "version": "16.9.8", "status": "affected" }, { "version": "16.10.1", "status": "affected" }, { "version": "16.10.1a", "status": "affected" }, { "version": "16.10.1b", "status": "affected" }, { "version": "16.10.1s", "status": "affected" }, { "version": "16.10.1c", "status": "affected" }, { "version": "16.10.1e", "status": "affected" }, { "version": "16.10.1d", "status": "affected" }, { "version": "16.10.2", "status": "affected" }, { "version": "16.10.1f", "status": "affected" }, { "version": "16.10.1g", "status": "affected" }, { "version": "16.10.3", "status": "affected" }, { "version": "3.10.0E", "status": "affected" }, { "version": "3.10.1E", "status": "affected" }, { "version": "3.10.0cE", "status": "affected" }, { "version": "3.10.2E", "status": "affected" }, { "version": "3.10.3E", "status": "affected" }, { "version": "16.11.1", "status": "affected" }, { "version": "16.11.1a", "status": "affected" }, { "version": "16.11.1b", "status": "affected" }, { "version": "16.11.2", "status": "affected" }, { "version": "16.11.1s", "status": "affected" }, { "version": "16.12.1", "status": "affected" }, { "version": "16.12.1s", "status": "affected" }, { "version": "16.12.1a", "status": "affected" }, { "version": "16.12.1c", "status": "affected" }, { "version": "16.12.1w", "status": "affected" }, { "version": "16.12.2", "status": "affected" }, { "version": "16.12.1y", "status": "affected" }, { "version": "16.12.2a", "status": "affected" }, { "version": "16.12.3", "status": "affected" }, { "version": "16.12.8", "status": "affected" }, { "version": "16.12.2s", "status": "affected" }, { "version": "16.12.1x", "status": "affected" }, { "version": "16.12.1t", "status": "affected" }, { "version": "16.12.4", "status": "affected" }, { "version": "16.12.3s", "status": "affected" }, { "version": "16.12.3a", "status": "affected" }, { "version": "16.12.4a", "status": "affected" }, { "version": "16.12.5", "status": "affected" }, { "version": "16.12.6", "status": "affected" }, { "version": "16.12.1z1", "status": "affected" }, { "version": "16.12.5a", "status": "affected" }, { "version": "16.12.5b", "status": "affected" }, { "version": "16.12.1z2", "status": "affected" }, { "version": "16.12.6a", "status": "affected" }, { "version": "16.12.7", "status": "affected" }, { "version": "16.12.9", "status": "affected" }, { "version": "3.11.0E", "status": "affected" }, { "version": "3.11.1E", "status": "affected" }, { "version": "3.11.2E", "status": "affected" }, { "version": "3.11.3E", "status": "affected" }, { "version": "3.11.1aE", "status": "affected" }, { "version": "3.11.4E", "status": "affected" }, { "version": "3.11.3aE", "status": "affected" }, { "version": "3.11.5E", "status": "affected" }, { "version": "3.11.6E", "status": "affected" }, { "version": "3.11.7E", "status": "affected" }, { "version": "3.11.8E", "status": "affected" }, { "version": "17.1.1", "status": "affected" }, { "version": "17.1.1a", "status": "affected" }, { "version": "17.1.1s", "status": "affected" }, { "version": "17.1.1t", "status": "affected" }, { "version": "17.1.3", "status": "affected" }, { "version": "17.2.1", "status": "affected" }, { "version": "17.2.1r", "status": "affected" }, { "version": "17.2.1a", "status": "affected" }, { "version": "17.2.1v", "status": "affected" }, { "version": "17.2.2", "status": "affected" }, { "version": "17.2.3", "status": "affected" }, { "version": "17.3.1", "status": "affected" }, { "version": "17.3.2", "status": "affected" }, { "version": "17.3.3", "status": "affected" }, { "version": "17.3.1a", "status": "affected" }, { "version": "17.3.1w", "status": "affected" }, { "version": "17.3.2a", "status": "affected" }, { "version": "17.3.1x", "status": "affected" }, { "version": "17.3.1z", "status": "affected" }, { "version": "17.3.4", "status": "affected" }, { "version": "17.3.5", "status": "affected" }, { "version": "17.3.4a", "status": "affected" }, { "version": "17.3.6", "status": "affected" }, { "version": "17.3.4b", "status": "affected" }, { "version": "17.3.4c", "status": "affected" }, { "version": "17.3.5a", "status": "affected" }, { "version": "17.3.5b", "status": "affected" }, { "version": "17.3.7", "status": "affected" }, { "version": "17.4.1", "status": "affected" }, { "version": "17.4.2", "status": "affected" }, { "version": "17.4.1a", "status": "affected" }, { "version": "17.4.1b", "status": "affected" }, { "version": "17.4.2a", "status": "affected" }, { "version": "17.5.1", "status": "affected" }, { "version": "17.5.1a", "status": "affected" }, { "version": "17.5.1c", "status": "affected" }, { "version": "17.6.1", "status": "affected" }, { "version": "17.6.2", "status": "affected" }, { "version": "17.6.1w", "status": "affected" }, { "version": "17.6.1a", "status": "affected" }, { "version": "17.6.1x", "status": "affected" }, { "version": "17.6.3", "status": "affected" }, { "version": "17.6.1y", "status": "affected" }, { "version": "17.6.1z", "status": "affected" }, { "version": "17.6.3a", "status": "affected" }, { "version": "17.6.4", "status": "affected" }, { "version": "17.6.1z1", "status": "affected" }, { "version": "17.6.5", "status": "affected" }, { "version": "17.6.5a", "status": "affected" }, { "version": "17.7.1", "status": "affected" }, { "version": "17.7.1a", "status": "affected" }, { "version": "17.7.1b", "status": "affected" }, { "version": "17.7.2", "status": "affected" }, { "version": "17.10.1", "status": "affected" }, { "version": "17.10.1a", "status": "affected" }, { "version": "17.10.1b", "status": "affected" }, { "version": "17.8.1", "status": "affected" }, { "version": "17.8.1a", "status": "affected" }, { "version": "17.9.1", "status": "affected" }, { "version": "17.9.1w", "status": "affected" }, { "version": "17.9.2", "status": "affected" }, { "version": "17.9.1a", "status": "affected" }, { "version": "17.9.1x", "status": "affected" }, { "version": "17.9.1y", "status": "affected" }, { "version": "17.9.3", "status": "affected" }, { "version": "17.9.2a", "status": "affected" }, { "version": "17.9.1x1", "status": "affected" }, { "version": "17.9.3a", "status": "affected" }, { "version": "17.9.1y1", "status": "affected" }, { "version": "17.11.1", "status": "affected" }, { "version": "17.11.1a", "status": "affected" }, { "version": "17.11.99SW", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-20109", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "fetchedAt": "2026-10-24T05:26:38.319Z", "publishedAt": "2023-09-27T17:23:21.589Z", "modifiedAt": "2025-10-21T23:05:36.370Z", "state": "published", "provider": "cisco", "title": "", "descriptions": [ { "lang": "en", "value": "A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.\r\n\r This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details [\"#details\"] section of this advisory.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Cisco", "product": "IOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.4(24)T", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "12.4(24)T3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "12.4(22)T1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "12.4(24)T5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "12.4(24)T4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "12.4(22)T", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "12.4(24)T8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "12.4(24)T2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "12.4(22)T5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "12.4(22)T4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "12.4(24)T1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "12.4(24)T7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "12.4(22)T3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "12.4(24)T6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "12.4(22)T2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "12.4(24)T4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "12.4(24)T4b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "12.4(24)T3e", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "12.4(24)T4c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "12.4(24)T4d", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "12.4(24)T4e", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "12.4(24)T3f", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "12.4(24)T4f", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "12.4(24)T4l", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "12.4(24)MD1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "12.4(24)MD", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "12.4(24)MD3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "12.4(24)MD2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "12.4(22)MD1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "12.4(22)MD2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "12.4(24)MD5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/31", "version": "12.4(22)MD", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/32", "version": "12.4(24)MD4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/33", "version": "12.4(24)MD6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/34", "version": "12.4(24)MD7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/35", "version": "12.4(22)XR5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/36", "version": "12.4(22)XR4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/37", "version": "12.4(22)XR7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/38", "version": "12.4(22)XR2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/39", "version": "12.4(22)XR6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/40", "version": "12.4(22)XR10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/41", "version": "12.4(22)XR1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/42", "version": "12.4(22)XR9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/43", "version": "12.4(22)XR3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/44", "version": "12.4(22)XR8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/45", "version": "12.4(22)XR11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/46", "version": "12.4(22)XR12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/47", "version": "12.4(22)MDA3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/48", "version": "12.4(24)MDA5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/49", "version": "12.4(22)MDA5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/50", "version": "12.4(24)MDA3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/51", "version": "12.4(22)MDA4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/52", "version": "12.4(24)MDA4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/53", "version": "12.4(24)MDA1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/54", "version": "12.4(22)MDA", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/55", "version": "12.4(22)MDA2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/56", "version": "12.4(22)MDA1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/57", "version": "12.4(24)MDA2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/58", "version": "12.4(22)MDA6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/59", "version": "12.4(24)MDA6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/60", "version": "12.4(24)MDA7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/61", "version": "12.4(24)MDA8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/62", "version": "12.4(24)MDA10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/63", "version": "12.4(24)MDA9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/64", "version": "12.4(24)MDA11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/65", "version": "12.4(24)MDA12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/66", "version": "12.4(24)MDA13", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/67", "version": "12.4(24)YG3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/68", "version": "12.4(24)YG4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/69", "version": "12.4(24)YG1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/70", "version": "12.4(24)YG2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/71", "version": "12.4(24)YG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/72", "version": "15.0(1)M1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/73", "version": "15.0(1)M5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/74", "version": "15.0(1)M4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/75", "version": "15.0(1)M3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/76", "version": "15.0(1)M2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/77", "version": "15.0(1)M6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/78", "version": "15.0(1)M", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/79", "version": "15.0(1)M7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/80", "version": "15.0(1)M10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/81", "version": "15.0(1)M9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/82", "version": "15.0(1)M8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/83", "version": "15.0(1)XA2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/84", "version": "15.0(1)XA4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/85", "version": "15.0(1)XA1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/86", "version": "15.0(1)XA3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/87", "version": "15.0(1)XA", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/88", "version": "15.0(1)XA5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/89", "version": "15.1(2)T", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/90", "version": "15.1(1)T4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/91", "version": "15.1(3)T2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/92", "version": "15.1(1)T1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/93", "version": "15.1(2)T0a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/94", "version": "15.1(3)T3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/95", "version": "15.1(1)T3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/96", "version": "15.1(2)T3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/97", "version": "15.1(2)T4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/98", "version": "15.1(1)T2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/99", "version": "15.1(3)T", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/100", "version": "15.1(2)T2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/101", "version": "15.1(3)T1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/102", "version": "15.1(1)T", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/103", "version": "15.1(2)T2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/104", "version": "15.1(2)T1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/105", "version": "15.1(2)T5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/106", "version": "15.1(3)T4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/107", "version": "15.1(1)T5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/108", "version": "15.1(1)XB", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/109", "version": "15.0(1)S2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/110", "version": "15.0(1)S1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/111", "version": "15.0(1)S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/112", "version": "15.0(1)S3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/113", "version": "15.0(1)S4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/114", "version": "15.0(1)S5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/115", "version": "15.0(1)S4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/116", "version": "15.0(1)S6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/117", "version": "15.2(1)S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/118", "version": "15.2(2)S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/119", "version": "15.2(1)S1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/120", "version": "15.2(4)S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/121", "version": "15.2(1)S2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/122", "version": "15.2(2)S1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/123", "version": "15.2(2)S2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/124", "version": "15.2(2)S0a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/125", "version": "15.2(2)S0c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/126", "version": "15.2(4)S1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/127", "version": "15.2(4)S4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/128", "version": "15.2(4)S6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/129", "version": "15.2(4)S2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/130", "version": "15.2(4)S5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/131", "version": "15.2(4)S3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/132", "version": "15.2(4)S3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/133", "version": "15.2(4)S4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/134", "version": "15.2(4)S7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/135", "version": "15.3(1)T", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/136", "version": "15.3(2)T", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/137", "version": "15.3(1)T1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/138", "version": "15.3(1)T2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/139", "version": "15.3(1)T3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/140", "version": "15.3(1)T4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/141", "version": "15.3(2)T1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/142", "version": "15.3(2)T2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/143", "version": "15.3(2)T3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/144", "version": "15.3(2)T4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/145", "version": "15.0(2)EY", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/146", "version": "15.0(2)EY1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/147", "version": "15.0(2)EY2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/148", "version": "15.0(2)EY3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/149", "version": "15.1(2)S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/150", "version": "15.1(1)S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/151", "version": "15.1(1)S1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/152", "version": "15.1(3)S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/153", "version": "15.1(1)S2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/154", "version": "15.1(2)S1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/155", "version": "15.1(2)S2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/156", "version": "15.1(3)S1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/157", "version": "15.1(3)S0a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/158", "version": "15.1(3)S2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/159", "version": "15.1(3)S4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/160", "version": "15.1(3)S3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/161", "version": "15.1(3)S5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/162", "version": "15.1(3)S6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/163", "version": "15.1(3)S5a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/164", "version": "15.1(4)M3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/165", "version": "15.1(4)M", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/166", "version": "15.1(4)M1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/167", "version": "15.1(4)M2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/168", "version": "15.1(4)M6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/169", "version": "15.1(4)M5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/170", "version": "15.1(4)M4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/171", "version": "15.1(4)M7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/172", "version": "15.1(4)M3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/173", "version": "15.1(4)M10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/174", "version": "15.1(4)M8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/175", "version": "15.1(4)M9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/176", "version": "15.0(2)SE", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/177", "version": "15.0(2)SE1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/178", "version": "15.0(2)SE2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/179", "version": "15.0(2)SE3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/180", "version": "15.0(2)SE4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/181", "version": "15.0(2)SE5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/182", "version": "15.0(2)SE6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/183", "version": "15.0(2)SE7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/184", "version": "15.0(2)SE8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/185", "version": "15.0(2)SE9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/186", "version": "15.0(2)SE10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/187", "version": "15.0(2)SE11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/188", "version": "15.0(2)SE10a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/189", "version": "15.0(2)SE12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/190", "version": "15.0(2)SE13", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/191", "version": "15.1(2)GC", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/192", "version": "15.1(2)GC1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/193", "version": "15.1(2)GC2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/194", "version": "15.1(4)GC", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/195", "version": "15.1(4)GC1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/196", "version": "15.1(4)GC2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/197", "version": "15.1(1)SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/198", "version": "15.1(2)SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/199", "version": "15.1(1)SG1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/200", "version": "15.1(1)SG2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/201", "version": "15.1(2)SG1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/202", "version": "15.1(2)SG2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/203", "version": "15.1(2)SG3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/204", "version": "15.1(2)SG4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/205", "version": "15.1(2)SG5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/206", "version": "15.1(2)SG6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/207", "version": "15.1(2)SG7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/208", "version": "15.1(2)SG8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/209", "version": "15.0(1)MR", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/210", "version": "15.0(2)MR", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/211", "version": "15.2(4)M", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/212", "version": "15.2(4)M1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/213", "version": "15.2(4)M2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/214", "version": "15.2(4)M4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/215", "version": "15.2(4)M3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/216", "version": "15.2(4)M5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/217", "version": "15.2(4)M8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/218", "version": "15.2(4)M10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/219", "version": "15.2(4)M7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/220", "version": "15.2(4)M6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/221", "version": "15.2(4)M9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/222", "version": "15.2(4)M6a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/223", "version": "15.2(4)M11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/224", "version": "12.4(24)MDB", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/225", "version": "12.4(24)MDB1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/226", "version": "12.4(24)MDB3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/227", "version": "12.4(24)MDB4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/228", "version": "12.4(24)MDB5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/229", "version": "12.4(24)MDB6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/230", "version": "12.4(24)MDB7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/231", "version": "12.4(24)MDB5a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/232", "version": "12.4(24)MDB8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/233", "version": "12.4(24)MDB9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/234", "version": "12.4(24)MDB10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/235", "version": "12.4(24)MDB11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/236", "version": "12.4(24)MDB12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/237", "version": "12.4(24)MDB13", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/238", "version": "12.4(24)MDB14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/239", "version": "12.4(24)MDB15", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/240", "version": "12.4(24)MDB16", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/241", "version": "12.4(24)MDB17", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/242", "version": "12.4(24)MDB18", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/243", "version": "12.4(24)MDB19", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/244", "version": "15.0(2)EX", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/245", "version": "15.0(2)EX1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/246", "version": "15.0(2)EX2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/247", "version": "15.0(2)EX3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/248", "version": "15.0(2)EX4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/249", "version": "15.0(2)EX5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/250", "version": "15.0(2)EX8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/251", "version": "15.0(2a)EX5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/252", "version": "15.0(2)EX10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/253", "version": "15.0(2)EX11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/254", "version": "15.0(2)EX13", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/255", "version": "15.0(2)EX12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/256", "version": "15.2(1)GC", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/257", "version": "15.2(1)GC1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/258", "version": "15.2(1)GC2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/259", "version": "15.2(2)GC", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/260", "version": "15.2(3)GC", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/261", "version": "15.2(3)GC1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/262", "version": "15.2(4)GC", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/263", "version": "15.2(4)GC1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/264", "version": "15.2(4)GC2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/265", "version": "15.2(4)GC3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/266", "version": "15.1(1)SY", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/267", "version": "15.1(1)SY1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/268", "version": "15.1(2)SY", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/269", "version": "15.1(2)SY1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/270", "version": "15.1(2)SY2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/271", "version": "15.1(1)SY2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/272", "version": "15.1(1)SY3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/273", "version": "15.1(2)SY3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/274", "version": "15.1(1)SY4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/275", "version": "15.1(2)SY4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/276", "version": "15.1(1)SY5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/277", "version": "15.1(2)SY5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/278", "version": "15.1(2)SY4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/279", "version": "15.1(1)SY6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/280", "version": "15.1(2)SY6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/281", "version": "15.1(2)SY7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/282", "version": "15.1(2)SY8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/283", "version": "15.1(2)SY9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/284", "version": "15.1(2)SY10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/285", "version": "15.1(2)SY11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/286", "version": "15.1(2)SY12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/287", "version": "15.1(2)SY13", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/288", "version": "15.1(2)SY14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/289", "version": "15.1(2)SY15", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/290", "version": "15.1(2)SY16", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/291", "version": "15.3(1)S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/292", "version": "15.3(2)S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/293", "version": "15.3(3)S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/294", "version": "15.3(1)S2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/295", "version": "15.3(1)S1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/296", "version": "15.3(2)S2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/297", "version": "15.3(2)S1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/298", "version": "15.3(3)S1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/299", "version": "15.3(3)S2", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco IOS XE Software", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "3.7.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "3.7.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "3.7.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "3.7.3S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "3.7.4S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "3.7.5S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "3.7.6S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "3.7.7S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/8", "version": "3.7.4aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/9", "version": "3.7.2tS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/10", "version": "3.7.0bS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/11", "version": "3.7.1aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/12", "version": "3.3.0SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/13", "version": "3.3.2SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/14", "version": "3.3.1SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/15", "version": "3.8.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/16", "version": "3.8.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/17", "version": "3.8.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/18", "version": "3.9.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/19", "version": "3.9.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/20", "version": "3.9.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/21", "version": "3.9.1aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/22", "version": "3.9.0aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/23", "version": "3.4.0SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/24", "version": "3.4.2SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/25", "version": "3.4.1SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/26", "version": "3.4.3SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/27", "version": "3.4.4SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/28", "version": "3.4.5SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/29", "version": "3.4.6SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/30", "version": "3.4.7SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/31", "version": "3.4.8SG", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/32", "version": "3.5.0E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/33", "version": "3.5.1E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/34", "version": "3.5.2E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/35", "version": "3.5.3E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/36", "version": "3.10.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/37", "version": "3.10.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/38", "version": "3.10.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/39", "version": "3.10.3S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/40", "version": "3.10.4S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/41", "version": "3.10.5S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/42", "version": "3.10.6S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/43", "version": "3.10.2tS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/44", "version": "3.10.7S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/45", "version": "3.10.1xbS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/46", "version": "3.10.8S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/47", "version": "3.10.8aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/48", "version": "3.10.9S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/49", "version": "3.10.10S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/50", "version": "3.11.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/51", "version": "3.11.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/52", "version": "3.11.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/53", "version": "3.11.3S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/54", "version": "3.11.4S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/55", "version": "3.12.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/56", "version": "3.12.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/57", "version": "3.12.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/58", "version": "3.12.3S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/59", "version": "3.12.0aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/60", "version": "3.12.4S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/61", "version": "3.13.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/62", "version": "3.13.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/63", "version": "3.13.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/64", "version": "3.13.3S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/65", "version": "3.13.4S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/66", "version": "3.13.5S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/67", "version": "3.13.2aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/68", "version": "3.13.0aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/69", "version": "3.13.5aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/70", "version": "3.13.6S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/71", "version": "3.13.7S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/72", "version": "3.13.6aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/73", "version": "3.13.7aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/74", "version": "3.13.8S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/75", "version": "3.13.9S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/76", "version": "3.13.10S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/77", "version": "3.6.0E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/78", "version": "3.6.1E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/79", "version": "3.6.2aE", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/80", "version": "3.6.2E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/81", "version": "3.6.3E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/82", "version": "3.6.4E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/83", "version": "3.6.5E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/84", "version": "3.6.6E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/85", "version": "3.6.5aE", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/86", "version": "3.6.5bE", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/87", "version": "3.6.7E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/88", "version": "3.6.8E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/89", "version": "3.6.7bE", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/90", "version": "3.6.9E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/91", "version": "3.6.10E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/92", "version": "3.14.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/93", "version": "3.14.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/94", "version": "3.14.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/95", "version": "3.14.3S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/96", "version": "3.14.4S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/97", "version": "3.15.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/98", "version": "3.15.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/99", "version": "3.15.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/100", "version": "3.15.1cS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/101", "version": "3.15.3S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/102", "version": "3.15.4S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/103", "version": "3.16.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/104", "version": "3.16.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/105", "version": "3.16.1aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/106", "version": "3.16.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/107", "version": "3.16.2aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/108", "version": "3.16.0cS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/109", "version": "3.16.3S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/110", "version": "3.16.2bS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/111", "version": "3.16.3aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/112", "version": "3.16.4S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/113", "version": "3.16.4aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/114", "version": "3.16.4bS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/115", "version": "3.16.5S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/116", "version": "3.16.4dS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/117", "version": "3.16.6S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/118", "version": "3.16.7S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/119", "version": "3.16.6bS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/120", "version": "3.16.7aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/121", "version": "3.16.7bS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/122", "version": "3.16.8S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/123", "version": "3.16.9S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/124", "version": "3.16.10S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/125", "version": "3.17.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/126", "version": "3.17.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/127", "version": "3.17.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/128", "version": "3.17.1aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/129", "version": "3.17.3S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/130", "version": "3.17.4S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/131", "version": "16.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/132", "version": "16.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/133", "version": "16.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/134", "version": "16.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/135", "version": "16.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/136", "version": "3.8.0E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/137", "version": "3.8.1E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/138", "version": "3.8.2E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/139", "version": "3.8.3E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/140", "version": "3.8.4E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/141", "version": "3.8.5E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/142", "version": "3.8.5aE", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/143", "version": "3.8.6E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/144", "version": "3.8.7E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/145", "version": "3.8.8E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/146", "version": "3.8.9E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/147", "version": "3.8.10E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/148", "version": "16.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/149", "version": "16.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/150", "version": "16.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/151", "version": "16.3.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/152", "version": "16.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/153", "version": "16.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/154", "version": "16.3.5b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/155", "version": "16.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/156", "version": "16.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/157", "version": "16.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/158", "version": "16.3.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/159", "version": "16.3.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/160", "version": "16.3.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/161", "version": "16.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/162", "version": "16.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/163", "version": "16.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/164", "version": "16.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/165", "version": "16.5.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/166", "version": "16.5.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/167", "version": "16.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/168", "version": "16.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/169", "version": "3.18.0aS", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/170", "version": "3.18.0S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/171", "version": "3.18.1S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/172", "version": "3.18.2S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/173", "version": "3.18.3S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/174", "version": "3.18.4S", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/175", "version": "3.18.0SP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/176", "version": "3.18.1SP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/177", "version": "3.18.1aSP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/178", "version": "3.18.1bSP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/179", "version": "3.18.1cSP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/180", "version": "3.18.2SP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/181", "version": "3.18.2aSP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/182", "version": "3.18.3SP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/183", "version": "3.18.4SP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/184", "version": "3.18.3aSP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/185", "version": "3.18.3bSP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/186", "version": "3.18.5SP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/187", "version": "3.18.6SP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/188", "version": "3.18.7SP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/189", "version": "3.18.8aSP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/190", "version": "3.18.9SP", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/191", "version": "3.9.0E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/192", "version": "3.9.1E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/193", "version": "3.9.2E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/194", "version": "16.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/195", "version": "16.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/196", "version": "16.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/197", "version": "16.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/198", "version": "16.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/199", "version": "16.6.4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/200", "version": "16.6.5a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/201", "version": "16.6.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/202", "version": "16.6.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/203", "version": "16.6.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/204", "version": "16.6.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/205", "version": "16.6.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/206", "version": "16.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/207", "version": "16.7.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/208", "version": "16.7.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/209", "version": "16.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/210", "version": "16.7.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/211", "version": "16.7.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/212", "version": "16.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/213", "version": "16.8.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/214", "version": "16.8.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/215", "version": "16.8.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/216", "version": "16.8.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/217", "version": "16.8.1d", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/218", "version": "16.8.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/219", "version": "16.8.1e", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/220", "version": "16.8.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/221", "version": "16.9.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/222", "version": "16.9.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/223", "version": "16.9.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/224", "version": "16.9.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/225", "version": "16.9.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/226", "version": "16.9.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/227", "version": "16.9.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/228", "version": "16.9.3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/229", "version": "16.9.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/230", "version": "16.9.5f", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/231", "version": "16.9.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/232", "version": "16.9.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/233", "version": "16.9.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/234", "version": "16.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/235", "version": "16.10.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/236", "version": "16.10.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/237", "version": "16.10.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/238", "version": "16.10.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/239", "version": "16.10.1e", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/240", "version": "16.10.1d", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/241", "version": "16.10.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/242", "version": "16.10.1f", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/243", "version": "16.10.1g", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/244", "version": "16.10.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/245", "version": "3.10.0E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/246", "version": "3.10.1E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/247", "version": "3.10.0cE", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/248", "version": "3.10.2E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/249", "version": "3.10.3E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/250", "version": "16.11.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/251", "version": "16.11.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/252", "version": "16.11.1b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/253", "version": "16.11.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/254", "version": "16.11.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/255", "version": "16.12.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/256", "version": "16.12.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/257", "version": "16.12.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/258", "version": "16.12.1c", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/259", "version": "16.12.1w", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/260", "version": "16.12.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/261", "version": "16.12.1y", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/262", "version": "16.12.2a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/263", "version": "16.12.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/264", "version": "16.12.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/265", "version": "16.12.2s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/266", "version": "16.12.1x", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/267", "version": "16.12.1t", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/268", "version": "16.12.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/269", "version": "16.12.3s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/270", "version": "16.12.3a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/271", "version": "16.12.4a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/272", "version": "16.12.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/273", "version": "16.12.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/274", "version": "16.12.1z1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/275", "version": "16.12.5a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/276", "version": "16.12.5b", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/277", "version": "16.12.1z2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/278", "version": "16.12.6a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/279", "version": "16.12.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/280", "version": "16.12.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/281", "version": "3.11.0E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/282", "version": "3.11.1E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/283", "version": "3.11.2E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/284", "version": "3.11.3E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/285", "version": "3.11.1aE", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/286", "version": "3.11.4E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/287", "version": "3.11.3aE", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/288", "version": "3.11.5E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/289", "version": "3.11.6E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/290", "version": "3.11.7E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/291", "version": "3.11.8E", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/292", "version": "17.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/293", "version": "17.1.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/294", "version": "17.1.1s", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/295", "version": "17.1.1t", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/296", "version": "17.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/297", "version": "17.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/298", "version": "17.2.1r", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/299", "version": "17.2.1a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "Cisco discovered attempted exploitation of the GET VPN feature and conducted a technical code review of the feature. This vulnerability was discovered during our internal investigation. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-787", "lang": "en", "description": "Out-of-bounds Write", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.6, "baseSeverity": "MEDIUM", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx", "label": "cisco-sa-getvpn-rce-g8qR68sx", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20109", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"IOS\",\"versions\":[{\"version\":\"12.4(24)T\",\"status\":\"affected\"},{\"version\":\"12.4(24)T3\",\"status\":\"affected\"},{\"version\":\"12.4(22)T1\",\"status\":\"affected\"},{\"version\":\"12.4(24)T5\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4\",\"status\":\"affected\"},{\"version\":\"12.4(22)T\",\"status\":\"affected\"},{\"version\":\"12.4(24)T8\",\"status\":\"affected\"},{\"version\":\"12.4(24)T2\",\"status\":\"affected\"},{\"version\":\"12.4(22)T5\",\"status\":\"affected\"},{\"version\":\"12.4(22)T4\",\"status\":\"affected\"},{\"version\":\"12.4(24)T1\",\"status\":\"affected\"},{\"version\":\"12.4(24)T7\",\"status\":\"affected\"},{\"version\":\"12.4(22)T3\",\"status\":\"affected\"},{\"version\":\"12.4(24)T6\",\"status\":\"affected\"},{\"version\":\"12.4(22)T2\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4a\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4b\",\"status\":\"affected\"},{\"version\":\"12.4(24)T3e\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4c\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4d\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4e\",\"status\":\"affected\"},{\"version\":\"12.4(24)T3f\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4f\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4l\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD1\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD3\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD2\",\"status\":\"affected\"},{\"version\":\"12.4(22)MD1\",\"status\":\"affected\"},{\"version\":\"12.4(22)MD2\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD5\",\"status\":\"affected\"},{\"version\":\"12.4(22)MD\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD4\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD6\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD7\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR5\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR4\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR7\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR2\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR6\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR10\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR1\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR9\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR3\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR8\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR11\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR12\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA3\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA5\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA5\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA3\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA4\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA4\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA1\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA2\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA1\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA2\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA6\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA6\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA7\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA8\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA10\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA9\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA11\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA12\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA13\",\"status\":\"affected\"},{\"version\":\"12.4(24)YG3\",\"status\":\"affected\"},{\"version\":\"12.4(24)YG4\",\"status\":\"affected\"},{\"version\":\"12.4(24)YG1\",\"status\":\"affected\"},{\"version\":\"12.4(24)YG2\",\"status\":\"affected\"},{\"version\":\"12.4(24)YG\",\"status\":\"affected\"},{\"version\":\"15.0(1)M1\",\"status\":\"affected\"},{\"version\":\"15.0(1)M5\",\"status\":\"affected\"},{\"version\":\"15.0(1)M4\",\"status\":\"affected\"},{\"version\":\"15.0(1)M3\",\"status\":\"affected\"},{\"version\":\"15.0(1)M2\",\"status\":\"affected\"},{\"version\":\"15.0(1)M6\",\"status\":\"affected\"},{\"version\":\"15.0(1)M\",\"status\":\"affected\"},{\"version\":\"15.0(1)M7\",\"status\":\"affected\"},{\"version\":\"15.0(1)M10\",\"status\":\"affected\"},{\"version\":\"15.0(1)M9\",\"status\":\"affected\"},{\"version\":\"15.0(1)M8\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA2\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA4\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA1\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA3\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA5\",\"status\":\"affected\"},{\"version\":\"15.1(2)T\",\"status\":\"affected\"},{\"version\":\"15.1(1)T4\",\"status\":\"affected\"},{\"version\":\"15.1(3)T2\",\"status\":\"affected\"},{\"version\":\"15.1(1)T1\",\"status\":\"affected\"},{\"version\":\"15.1(2)T0a\",\"status\":\"affected\"},{\"version\":\"15.1(3)T3\",\"status\":\"affected\"},{\"version\":\"15.1(1)T3\",\"status\":\"affected\"},{\"version\":\"15.1(2)T3\",\"status\":\"affected\"},{\"version\":\"15.1(2)T4\",\"status\":\"affected\"},{\"version\":\"15.1(1)T2\",\"status\":\"affected\"},{\"version\":\"15.1(3)T\",\"status\":\"affected\"},{\"version\":\"15.1(2)T2a\",\"status\":\"affected\"},{\"version\":\"15.1(3)T1\",\"status\":\"affected\"},{\"version\":\"15.1(1)T\",\"status\":\"affected\"},{\"version\":\"15.1(2)T2\",\"status\":\"affected\"},{\"version\":\"15.1(2)T1\",\"status\":\"affected\"},{\"version\":\"15.1(2)T5\",\"status\":\"affected\"},{\"version\":\"15.1(3)T4\",\"status\":\"affected\"},{\"version\":\"15.1(1)T5\",\"status\":\"affected\"},{\"version\":\"15.1(1)XB\",\"status\":\"affected\"},{\"version\":\"15.0(1)S2\",\"status\":\"affected\"},{\"version\":\"15.0(1)S1\",\"status\":\"affected\"},{\"version\":\"15.0(1)S\",\"status\":\"affected\"},{\"version\":\"15.0(1)S3a\",\"status\":\"affected\"},{\"version\":\"15.0(1)S4\",\"status\":\"affected\"},{\"version\":\"15.0(1)S5\",\"status\":\"affected\"},{\"version\":\"15.0(1)S4a\",\"status\":\"affected\"},{\"version\":\"15.0(1)S6\",\"status\":\"affected\"},{\"version\":\"15.2(1)S\",\"status\":\"affected\"},{\"version\":\"15.2(2)S\",\"status\":\"affected\"},{\"version\":\"15.2(1)S1\",\"status\":\"affected\"},{\"version\":\"15.2(4)S\",\"status\":\"affected\"},{\"version\":\"15.2(1)S2\",\"status\":\"affected\"},{\"version\":\"15.2(2)S1\",\"status\":\"affected\"},{\"version\":\"15.2(2)S2\",\"status\":\"affected\"},{\"version\":\"15.2(2)S0a\",\"status\":\"affected\"},{\"version\":\"15.2(2)S0c\",\"status\":\"affected\"},{\"version\":\"15.2(4)S1\",\"status\":\"affected\"},{\"version\":\"15.2(4)S4\",\"status\":\"affected\"},{\"version\":\"15.2(4)S6\",\"status\":\"affected\"},{\"version\":\"15.2(4)S2\",\"status\":\"affected\"},{\"version\":\"15.2(4)S5\",\"status\":\"affected\"},{\"version\":\"15.2(4)S3\",\"status\":\"affected\"},{\"version\":\"15.2(4)S3a\",\"status\":\"affected\"},{\"version\":\"15.2(4)S4a\",\"status\":\"affected\"},{\"version\":\"15.2(4)S7\",\"status\":\"affected\"},{\"version\":\"15.3(1)T\",\"status\":\"affected\"},{\"version\":\"15.3(2)T\",\"status\":\"affected\"},{\"version\":\"15.3(1)T1\",\"status\":\"affected\"},{\"version\":\"15.3(1)T2\",\"status\":\"affected\"},{\"version\":\"15.3(1)T3\",\"status\":\"affected\"},{\"version\":\"15.3(1)T4\",\"status\":\"affected\"},{\"version\":\"15.3(2)T1\",\"status\":\"affected\"},{\"version\":\"15.3(2)T2\",\"status\":\"affected\"},{\"version\":\"15.3(2)T3\",\"status\":\"affected\"},{\"version\":\"15.3(2)T4\",\"status\":\"affected\"},{\"version\":\"15.0(2)EY\",\"status\":\"affected\"},{\"version\":\"15.0(2)EY1\",\"status\":\"affected\"},{\"version\":\"15.0(2)EY2\",\"status\":\"affected\"},{\"version\":\"15.0(2)EY3\",\"status\":\"affected\"},{\"version\":\"15.1(2)S\",\"status\":\"affected\"},{\"version\":\"15.1(1)S\",\"status\":\"affected\"},{\"version\":\"15.1(1)S1\",\"status\":\"affected\"},{\"version\":\"15.1(3)S\",\"status\":\"affected\"},{\"version\":\"15.1(1)S2\",\"status\":\"affected\"},{\"version\":\"15.1(2)S1\",\"status\":\"affected\"},{\"version\":\"15.1(2)S2\",\"status\":\"affected\"},{\"version\":\"15.1(3)S1\",\"status\":\"affected\"},{\"version\":\"15.1(3)S0a\",\"status\":\"affected\"},{\"version\":\"15.1(3)S2\",\"status\":\"affected\"},{\"version\":\"15.1(3)S4\",\"status\":\"affected\"},{\"version\":\"15.1(3)S3\",\"status\":\"affected\"},{\"version\":\"15.1(3)S5\",\"status\":\"affected\"},{\"version\":\"15.1(3)S6\",\"status\":\"affected\"},{\"version\":\"15.1(3)S5a\",\"status\":\"affected\"},{\"version\":\"15.1(4)M3\",\"status\":\"affected\"},{\"version\":\"15.1(4)M\",\"status\":\"affected\"},{\"version\":\"15.1(4)M1\",\"status\":\"affected\"},{\"version\":\"15.1(4)M2\",\"status\":\"affected\"},{\"version\":\"15.1(4)M6\",\"status\":\"affected\"},{\"version\":\"15.1(4)M5\",\"status\":\"affected\"},{\"version\":\"15.1(4)M4\",\"status\":\"affected\"},{\"version\":\"15.1(4)M7\",\"status\":\"affected\"},{\"version\":\"15.1(4)M3a\",\"status\":\"affected\"},{\"version\":\"15.1(4)M10\",\"status\":\"affected\"},{\"version\":\"15.1(4)M8\",\"status\":\"affected\"},{\"version\":\"15.1(4)M9\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE1\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE2\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE3\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE4\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE5\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE6\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE7\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE8\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE9\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE10\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE11\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE10a\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE12\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE13\",\"status\":\"affected\"},{\"version\":\"15.1(2)GC\",\"status\":\"affected\"},{\"version\":\"15.1(2)GC1\",\"status\":\"affected\"},{\"version\":\"15.1(2)GC2\",\"status\":\"affected\"},{\"version\":\"15.1(4)GC\",\"status\":\"affected\"},{\"version\":\"15.1(4)GC1\",\"status\":\"affected\"},{\"version\":\"15.1(4)GC2\",\"status\":\"affected\"},{\"version\":\"15.1(1)SG\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG\",\"status\":\"affected\"},{\"version\":\"15.1(1)SG1\",\"status\":\"affected\"},{\"version\":\"15.1(1)SG2\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG1\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG2\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG3\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG4\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG5\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG6\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG7\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG8\",\"status\":\"affected\"},{\"version\":\"15.0(1)MR\",\"status\":\"affected\"},{\"version\":\"15.0(2)MR\",\"status\":\"affected\"},{\"version\":\"15.2(4)M\",\"status\":\"affected\"},{\"version\":\"15.2(4)M1\",\"status\":\"affected\"},{\"version\":\"15.2(4)M2\",\"status\":\"affected\"},{\"version\":\"15.2(4)M4\",\"status\":\"affected\"},{\"version\":\"15.2(4)M3\",\"status\":\"affected\"},{\"version\":\"15.2(4)M5\",\"status\":\"affected\"},{\"version\":\"15.2(4)M8\",\"status\":\"affected\"},{\"version\":\"15.2(4)M10\",\"status\":\"affected\"},{\"version\":\"15.2(4)M7\",\"status\":\"affected\"},{\"version\":\"15.2(4)M6\",\"status\":\"affected\"},{\"version\":\"15.2(4)M9\",\"status\":\"affected\"},{\"version\":\"15.2(4)M6a\",\"status\":\"affected\"},{\"version\":\"15.2(4)M11\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB1\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB3\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB4\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB5\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB6\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB7\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB5a\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB8\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB9\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB10\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB11\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB12\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB13\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB14\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB15\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB16\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB17\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB18\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB19\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX1\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX2\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX3\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX4\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX5\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX8\",\"status\":\"affected\"},{\"version\":\"15.0(2a)EX5\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX10\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX11\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX13\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX12\",\"status\":\"affected\"},{\"version\":\"15.2(1)GC\",\"status\":\"affected\"},{\"version\":\"15.2(1)GC1\",\"status\":\"affected\"},{\"version\":\"15.2(1)GC2\",\"status\":\"affected\"},{\"version\":\"15.2(2)GC\",\"status\":\"affected\"},{\"version\":\"15.2(3)GC\",\"status\":\"affected\"},{\"version\":\"15.2(3)GC1\",\"status\":\"affected\"},{\"version\":\"15.2(4)GC\",\"status\":\"affected\"},{\"version\":\"15.2(4)GC1\",\"status\":\"affected\"},{\"version\":\"15.2(4)GC2\",\"status\":\"affected\"},{\"version\":\"15.2(4)GC3\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY1\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY1\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY2\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY2\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY3\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY3\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY4\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY4\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY5\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY5\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY4a\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY6\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY6\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY7\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY8\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY9\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY10\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY11\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY12\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY13\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY14\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY15\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY16\",\"status\":\"affected\"},{\"version\":\"15.3(1)S\",\"status\":\"affected\"},{\"version\":\"15.3(2)S\",\"status\":\"affected\"},{\"version\":\"15.3(3)S\",\"status\":\"affected\"},{\"version\":\"15.3(1)S2\",\"status\":\"affected\"},{\"version\":\"15.3(1)S1\",\"status\":\"affected\"},{\"version\":\"15.3(2)S2\",\"status\":\"affected\"},{\"version\":\"15.3(2)S1\",\"status\":\"affected\"},{\"version\":\"15.3(3)S1\",\"status\":\"affected\"},{\"version\":\"15.3(3)S2\",\"status\":\"affected\"},{\"version\":\"15.3(3)S3\",\"status\":\"affected\"},{\"version\":\"15.3(3)S6\",\"status\":\"affected\"},{\"version\":\"15.3(3)S4\",\"status\":\"affected\"},{\"version\":\"15.3(3)S1a\",\"status\":\"affected\"},{\"version\":\"15.3(3)S5\",\"status\":\"affected\"},{\"version\":\"15.3(3)S7\",\"status\":\"affected\"},{\"version\":\"15.3(3)S8\",\"status\":\"affected\"},{\"version\":\"15.3(3)S9\",\"status\":\"affected\"},{\"version\":\"15.3(3)S10\",\"status\":\"affected\"},{\"version\":\"15.3(3)S8a\",\"status\":\"affected\"},{\"version\":\"15.4(1)T\",\"status\":\"affected\"},{\"version\":\"15.4(2)T\",\"status\":\"affected\"},{\"version\":\"15.4(1)T2\",\"status\":\"affected\"},{\"version\":\"15.4(1)T1\",\"status\":\"affected\"},{\"version\":\"15.4(1)T3\",\"status\":\"affected\"},{\"version\":\"15.4(2)T1\",\"status\":\"affected\"},{\"version\":\"15.4(2)T3\",\"status\":\"affected\"},{\"version\":\"15.4(2)T2\",\"status\":\"affected\"},{\"version\":\"15.4(1)T4\",\"status\":\"affected\"},{\"version\":\"15.4(2)T4\",\"status\":\"affected\"},{\"version\":\"15.0(2)EA\",\"status\":\"affected\"},{\"version\":\"15.0(2)EA1\",\"status\":\"affected\"},{\"version\":\"15.2(1)E\",\"status\":\"affected\"},{\"version\":\"15.2(2)E\",\"status\":\"affected\"},{\"version\":\"15.2(1)E1\",\"status\":\"affected\"},{\"version\":\"15.2(3)E\",\"status\":\"affected\"},{\"version\":\"15.2(1)E2\",\"status\":\"affected\"},{\"version\":\"15.2(1)E3\",\"status\":\"affected\"},{\"version\":\"15.2(2)E1\",\"status\":\"affected\"},{\"version\":\"15.2(4)E\",\"status\":\"affected\"},{\"version\":\"15.2(3)E1\",\"status\":\"affected\"},{\"version\":\"15.2(2)E2\",\"status\":\"affected\"},{\"version\":\"15.2(2a)E1\",\"status\":\"affected\"},{\"version\":\"15.2(2)E3\",\"status\":\"affected\"},{\"version\":\"15.2(2a)E2\",\"status\":\"affected\"},{\"version\":\"15.2(3)E2\",\"status\":\"affected\"},{\"version\":\"15.2(3a)E\",\"status\":\"affected\"},{\"version\":\"15.2(3)E3\",\"status\":\"affected\"},{\"version\":\"15.2(4)E1\",\"status\":\"affected\"},{\"version\":\"15.2(2)E4\",\"status\":\"affected\"},{\"version\":\"15.2(2)E5\",\"status\":\"affected\"},{\"version\":\"15.2(4)E2\",\"status\":\"affected\"},{\"version\":\"15.2(3)E4\",\"status\":\"affected\"},{\"version\":\"15.2(5)E\",\"status\":\"affected\"},{\"version\":\"15.2(4)E3\",\"status\":\"affected\"},{\"version\":\"15.2(2)E6\",\"status\":\"affected\"},{\"version\":\"15.2(5a)E\",\"status\":\"affected\"},{\"version\":\"15.2(5)E1\",\"status\":\"affected\"},{\"version\":\"15.2(5b)E\",\"status\":\"affected\"},{\"version\":\"15.2(2)E5a\",\"status\":\"affected\"},{\"version\":\"15.2(5c)E\",\"status\":\"affected\"},{\"version\":\"15.2(3)E5\",\"status\":\"affected\"},{\"version\":\"15.2(2)E5b\",\"status\":\"affected\"},{\"version\":\"15.2(5a)E1\",\"status\":\"affected\"},{\"version\":\"15.2(4)E4\",\"status\":\"affected\"},{\"version\":\"15.2(2)E7\",\"status\":\"affected\"},{\"version\":\"15.2(5)E2\",\"status\":\"affected\"},{\"version\":\"15.2(6)E\",\"status\":\"affected\"},{\"version\":\"15.2(5)E2b\",\"status\":\"affected\"},{\"version\":\"15.2(4)E5\",\"status\":\"affected\"},{\"version\":\"15.2(5)E2c\",\"status\":\"affected\"},{\"version\":\"15.2(2)E8\",\"status\":\"affected\"},{\"version\":\"15.2(6)E0a\",\"status\":\"affected\"},{\"version\":\"15.2(6)E1\",\"status\":\"affected\"},{\"version\":\"15.2(2)E7b\",\"status\":\"affected\"},{\"version\":\"15.2(4)E5a\",\"status\":\"affected\"},{\"version\":\"15.2(6)E0c\",\"status\":\"affected\"},{\"version\":\"15.2(4)E6\",\"status\":\"affected\"},{\"version\":\"15.2(6)E2\",\"status\":\"affected\"},{\"version\":\"15.2(2)E9\",\"status\":\"affected\"},{\"version\":\"15.2(4)E7\",\"status\":\"affected\"},{\"version\":\"15.2(7)E\",\"status\":\"affected\"},{\"version\":\"15.2(2)E10\",\"status\":\"affected\"},{\"version\":\"15.2(4)E8\",\"status\":\"affected\"},{\"version\":\"15.2(6)E2a\",\"status\":\"affected\"},{\"version\":\"15.2(6)E2b\",\"status\":\"affected\"},{\"version\":\"15.2(7)E1\",\"status\":\"affected\"},{\"version\":\"15.2(7)E0a\",\"status\":\"affected\"},{\"version\":\"15.2(7)E0b\",\"status\":\"affected\"},{\"version\":\"15.2(7)E0s\",\"status\":\"affected\"},{\"version\":\"15.2(6)E3\",\"status\":\"affected\"},{\"version\":\"15.2(4)E9\",\"status\":\"affected\"},{\"version\":\"15.2(7)E2\",\"status\":\"affected\"},{\"version\":\"15.2(7a)E0b\",\"status\":\"affected\"},{\"version\":\"15.2(4)E10\",\"status\":\"affected\"},{\"version\":\"15.2(7)E3\",\"status\":\"affected\"},{\"version\":\"15.2(7)E1a\",\"status\":\"affected\"},{\"version\":\"15.2(7b)E0b\",\"status\":\"affected\"},{\"version\":\"15.2(7)E2a\",\"status\":\"affected\"},{\"version\":\"15.2(4)E10a\",\"status\":\"affected\"},{\"version\":\"15.2(7)E4\",\"status\":\"affected\"},{\"version\":\"15.2(7)E3k\",\"status\":\"affected\"},{\"version\":\"15.2(8)E\",\"status\":\"affected\"},{\"version\":\"15.2(8)E1\",\"status\":\"affected\"},{\"version\":\"15.2(7)E5\",\"status\":\"affected\"},{\"version\":\"15.2(7)E6\",\"status\":\"affected\"},{\"version\":\"15.2(8)E2\",\"status\":\"affected\"},{\"version\":\"15.2(4)E10d\",\"status\":\"affected\"},{\"version\":\"15.2(7)E7\",\"status\":\"affected\"},{\"version\":\"15.2(8)E3\",\"status\":\"affected\"},{\"version\":\"15.2(7)E8\",\"status\":\"affected\"},{\"version\":\"15.2(8)E4\",\"status\":\"affected\"},{\"version\":\"15.1(3)MRA\",\"status\":\"affected\"},{\"version\":\"15.1(3)MRA1\",\"status\":\"affected\"},{\"version\":\"15.1(3)MRA2\",\"status\":\"affected\"},{\"version\":\"15.1(3)MRA3\",\"status\":\"affected\"},{\"version\":\"15.1(3)MRA4\",\"status\":\"affected\"},{\"version\":\"15.1(3)SVB1\",\"status\":\"affected\"},{\"version\":\"15.1(3)SVB2\",\"status\":\"affected\"},{\"version\":\"15.4(1)S\",\"status\":\"affected\"},{\"version\":\"15.4(2)S\",\"status\":\"affected\"},{\"version\":\"15.4(3)S\",\"status\":\"affected\"},{\"version\":\"15.4(1)S1\",\"status\":\"affected\"},{\"version\":\"15.4(1)S2\",\"status\":\"affected\"},{\"version\":\"15.4(2)S1\",\"status\":\"affected\"},{\"version\":\"15.4(1)S3\",\"status\":\"affected\"},{\"version\":\"15.4(3)S1\",\"status\":\"affected\"},{\"version\":\"15.4(2)S2\",\"status\":\"affected\"},{\"version\":\"15.4(3)S2\",\"status\":\"affected\"},{\"version\":\"15.4(3)S3\",\"status\":\"affected\"},{\"version\":\"15.4(1)S4\",\"status\":\"affected\"},{\"version\":\"15.4(2)S3\",\"status\":\"affected\"},{\"version\":\"15.4(2)S4\",\"status\":\"affected\"},{\"version\":\"15.4(3)S4\",\"status\":\"affected\"},{\"version\":\"15.4(3)S5\",\"status\":\"affected\"},{\"version\":\"15.4(3)S6\",\"status\":\"affected\"},{\"version\":\"15.4(3)S7\",\"status\":\"affected\"},{\"version\":\"15.4(3)S6a\",\"status\":\"affected\"},{\"version\":\"15.4(3)S8\",\"status\":\"affected\"},{\"version\":\"15.4(3)S9\",\"status\":\"affected\"},{\"version\":\"15.4(3)S10\",\"status\":\"affected\"},{\"version\":\"15.3(3)M\",\"status\":\"affected\"},{\"version\":\"15.3(3)M1\",\"status\":\"affected\"},{\"version\":\"15.3(3)M2\",\"status\":\"affected\"},{\"version\":\"15.3(3)M3\",\"status\":\"affected\"},{\"version\":\"15.3(3)M5\",\"status\":\"affected\"},{\"version\":\"15.3(3)M4\",\"status\":\"affected\"},{\"version\":\"15.3(3)M6\",\"status\":\"affected\"},{\"version\":\"15.3(3)M7\",\"status\":\"affected\"},{\"version\":\"15.3(3)M8\",\"status\":\"affected\"},{\"version\":\"15.3(3)M9\",\"status\":\"affected\"},{\"version\":\"15.3(3)M10\",\"status\":\"affected\"},{\"version\":\"15.3(3)M8a\",\"status\":\"affected\"},{\"version\":\"15.0(2)EZ\",\"status\":\"affected\"},{\"version\":\"15.1(3)SVD\",\"status\":\"affected\"},{\"version\":\"15.1(3)SVD1\",\"status\":\"affected\"},{\"version\":\"15.1(3)SVD2\",\"status\":\"affected\"},{\"version\":\"15.2(1)EY\",\"status\":\"affected\"},{\"version\":\"15.0(2)EJ\",\"status\":\"affected\"},{\"version\":\"15.0(2)EJ1\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY1\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY0a\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY2\",\"status\":\"affected\"},{\"version\":\"15.2(2)SY\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY1a\",\"status\":\"affected\"},{\"version\":\"15.2(2)SY1\",\"status\":\"affected\"},{\"version\":\"15.2(2)SY2\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY3\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY4\",\"status\":\"affected\"},{\"version\":\"15.2(2)SY3\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY5\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY6\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY7\",\"status\":\"affected\"},{\"version\":\"15.2(1)SY8\",\"status\":\"affected\"},{\"version\":\"15.2(5)EX\",\"status\":\"affected\"},{\"version\":\"15.1(3)SVF\",\"status\":\"affected\"},{\"version\":\"15.1(3)SVF1\",\"status\":\"affected\"},{\"version\":\"15.1(3)SVE\",\"status\":\"affected\"},{\"version\":\"15.4(3)M\",\"status\":\"affected\"},{\"version\":\"15.4(3)M1\",\"status\":\"affected\"},{\"version\":\"15.4(3)M2\",\"status\":\"affected\"},{\"version\":\"15.4(3)M3\",\"status\":\"affected\"},{\"version\":\"15.4(3)M4\",\"status\":\"affected\"},{\"version\":\"15.4(3)M5\",\"status\":\"affected\"},{\"version\":\"15.4(3)M6\",\"status\":\"affected\"},{\"version\":\"15.4(3)M7\",\"status\":\"affected\"},{\"version\":\"15.4(3)M6a\",\"status\":\"affected\"},{\"version\":\"15.4(3)M8\",\"status\":\"affected\"},{\"version\":\"15.4(3)M9\",\"status\":\"affected\"},{\"version\":\"15.4(3)M10\",\"status\":\"affected\"},{\"version\":\"15.0(2)EK\",\"status\":\"affected\"},{\"version\":\"15.0(2)EK1\",\"status\":\"affected\"},{\"version\":\"15.4(1)CG\",\"status\":\"affected\"},{\"version\":\"15.4(1)CG1\",\"status\":\"affected\"},{\"version\":\"15.4(2)CG\",\"status\":\"affected\"},{\"version\":\"15.5(1)S\",\"status\":\"affected\"},{\"version\":\"15.5(2)S\",\"status\":\"affected\"},{\"version\":\"15.5(1)S1\",\"status\":\"affected\"},{\"version\":\"15.5(3)S\",\"status\":\"affected\"},{\"version\":\"15.5(1)S2\",\"status\":\"affected\"},{\"version\":\"15.5(1)S3\",\"status\":\"affected\"},{\"version\":\"15.5(2)S1\",\"status\":\"affected\"},{\"version\":\"15.5(2)S2\",\"status\":\"affected\"},{\"version\":\"15.5(3)S1\",\"status\":\"affected\"},{\"version\":\"15.5(3)S1a\",\"status\":\"affected\"},{\"version\":\"15.5(2)S3\",\"status\":\"affected\"},{\"version\":\"15.5(3)S2\",\"status\":\"affected\"},{\"version\":\"15.5(3)S0a\",\"status\":\"affected\"},{\"version\":\"15.5(3)S3\",\"status\":\"affected\"},{\"version\":\"15.5(1)S4\",\"status\":\"affected\"},{\"version\":\"15.5(2)S4\",\"status\":\"affected\"},{\"version\":\"15.5(3)S4\",\"status\":\"affected\"},{\"version\":\"15.5(3)S5\",\"status\":\"affected\"},{\"version\":\"15.5(3)S6\",\"status\":\"affected\"},{\"version\":\"15.5(3)S6a\",\"status\":\"affected\"},{\"version\":\"15.5(3)S7\",\"status\":\"affected\"},{\"version\":\"15.5(3)S6b\",\"status\":\"affected\"},{\"version\":\"15.5(3)S8\",\"status\":\"affected\"},{\"version\":\"15.5(3)S9\",\"status\":\"affected\"},{\"version\":\"15.5(3)S10\",\"status\":\"affected\"},{\"version\":\"15.5(3)S9a\",\"status\":\"affected\"},{\"version\":\"15.1(3)SVG\",\"status\":\"affected\"},{\"version\":\"15.2(2)EB\",\"status\":\"affected\"},{\"version\":\"15.2(2)EB1\",\"status\":\"affected\"},{\"version\":\"15.2(2)EB2\",\"status\":\"affected\"},{\"version\":\"15.2(6)EB\",\"status\":\"affected\"},{\"version\":\"15.5(1)T\",\"status\":\"affected\"},{\"version\":\"15.5(1)T1\",\"status\":\"affected\"},{\"version\":\"15.5(2)T\",\"status\":\"affected\"},{\"version\":\"15.5(1)T2\",\"status\":\"affected\"},{\"version\":\"15.5(1)T3\",\"status\":\"affected\"},{\"version\":\"15.5(2)T1\",\"status\":\"affected\"},{\"version\":\"15.5(2)T2\",\"status\":\"affected\"},{\"version\":\"15.5(2)T3\",\"status\":\"affected\"},{\"version\":\"15.5(2)T4\",\"status\":\"affected\"},{\"version\":\"15.5(1)T4\",\"status\":\"affected\"},{\"version\":\"15.2(2)EA\",\"status\":\"affected\"},{\"version\":\"15.2(2)EA1\",\"status\":\"affected\"},{\"version\":\"15.2(2)EA2\",\"status\":\"affected\"},{\"version\":\"15.2(3)EA\",\"status\":\"affected\"},{\"version\":\"15.2(4)EA\",\"status\":\"affected\"},{\"version\":\"15.2(4)EA1\",\"status\":\"affected\"},{\"version\":\"15.2(2)EA3\",\"status\":\"affected\"},{\"version\":\"15.2(4)EA3\",\"status\":\"affected\"},{\"version\":\"15.2(5)EA\",\"stat", "truncated": true, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco IOS XE Software\",\"versions\":[{\"version\":\"3.7.0S\",\"status\":\"affected\"},{\"version\":\"3.7.1S\",\"status\":\"affected\"},{\"version\":\"3.7.2S\",\"status\":\"affected\"},{\"version\":\"3.7.3S\",\"status\":\"affected\"},{\"version\":\"3.7.4S\",\"status\":\"affected\"},{\"version\":\"3.7.5S\",\"status\":\"affected\"},{\"version\":\"3.7.6S\",\"status\":\"affected\"},{\"version\":\"3.7.7S\",\"status\":\"affected\"},{\"version\":\"3.7.4aS\",\"status\":\"affected\"},{\"version\":\"3.7.2tS\",\"status\":\"affected\"},{\"version\":\"3.7.0bS\",\"status\":\"affected\"},{\"version\":\"3.7.1aS\",\"status\":\"affected\"},{\"version\":\"3.3.0SG\",\"status\":\"affected\"},{\"version\":\"3.3.2SG\",\"status\":\"affected\"},{\"version\":\"3.3.1SG\",\"status\":\"affected\"},{\"version\":\"3.8.0S\",\"status\":\"affected\"},{\"version\":\"3.8.1S\",\"status\":\"affected\"},{\"version\":\"3.8.2S\",\"status\":\"affected\"},{\"version\":\"3.9.1S\",\"status\":\"affected\"},{\"version\":\"3.9.0S\",\"status\":\"affected\"},{\"version\":\"3.9.2S\",\"status\":\"affected\"},{\"version\":\"3.9.1aS\",\"status\":\"affected\"},{\"version\":\"3.9.0aS\",\"status\":\"affected\"},{\"version\":\"3.4.0SG\",\"status\":\"affected\"},{\"version\":\"3.4.2SG\",\"status\":\"affected\"},{\"version\":\"3.4.1SG\",\"status\":\"affected\"},{\"version\":\"3.4.3SG\",\"status\":\"affected\"},{\"version\":\"3.4.4SG\",\"status\":\"affected\"},{\"version\":\"3.4.5SG\",\"status\":\"affected\"},{\"version\":\"3.4.6SG\",\"status\":\"affected\"},{\"version\":\"3.4.7SG\",\"status\":\"affected\"},{\"version\":\"3.4.8SG\",\"status\":\"affected\"},{\"version\":\"3.5.0E\",\"status\":\"affected\"},{\"version\":\"3.5.1E\",\"status\":\"affected\"},{\"version\":\"3.5.2E\",\"status\":\"affected\"},{\"version\":\"3.5.3E\",\"status\":\"affected\"},{\"version\":\"3.10.0S\",\"status\":\"affected\"},{\"version\":\"3.10.1S\",\"status\":\"affected\"},{\"version\":\"3.10.2S\",\"status\":\"affected\"},{\"version\":\"3.10.3S\",\"status\":\"affected\"},{\"version\":\"3.10.4S\",\"status\":\"affected\"},{\"version\":\"3.10.5S\",\"status\":\"affected\"},{\"version\":\"3.10.6S\",\"status\":\"affected\"},{\"version\":\"3.10.2tS\",\"status\":\"affected\"},{\"version\":\"3.10.7S\",\"status\":\"affected\"},{\"version\":\"3.10.1xbS\",\"status\":\"affected\"},{\"version\":\"3.10.8S\",\"status\":\"affected\"},{\"version\":\"3.10.8aS\",\"status\":\"affected\"},{\"version\":\"3.10.9S\",\"status\":\"affected\"},{\"version\":\"3.10.10S\",\"status\":\"affected\"},{\"version\":\"3.11.1S\",\"status\":\"affected\"},{\"version\":\"3.11.2S\",\"status\":\"affected\"},{\"version\":\"3.11.0S\",\"status\":\"affected\"},{\"version\":\"3.11.3S\",\"status\":\"affected\"},{\"version\":\"3.11.4S\",\"status\":\"affected\"},{\"version\":\"3.12.0S\",\"status\":\"affected\"},{\"version\":\"3.12.1S\",\"status\":\"affected\"},{\"version\":\"3.12.2S\",\"status\":\"affected\"},{\"version\":\"3.12.3S\",\"status\":\"affected\"},{\"version\":\"3.12.0aS\",\"status\":\"affected\"},{\"version\":\"3.12.4S\",\"status\":\"affected\"},{\"version\":\"3.13.0S\",\"status\":\"affected\"},{\"version\":\"3.13.1S\",\"status\":\"affected\"},{\"version\":\"3.13.2S\",\"status\":\"affected\"},{\"version\":\"3.13.3S\",\"status\":\"affected\"},{\"version\":\"3.13.4S\",\"status\":\"affected\"},{\"version\":\"3.13.5S\",\"status\":\"affected\"},{\"version\":\"3.13.2aS\",\"status\":\"affected\"},{\"version\":\"3.13.0aS\",\"status\":\"affected\"},{\"version\":\"3.13.5aS\",\"status\":\"affected\"},{\"version\":\"3.13.6S\",\"status\":\"affected\"},{\"version\":\"3.13.7S\",\"status\":\"affected\"},{\"version\":\"3.13.6aS\",\"status\":\"affected\"},{\"version\":\"3.13.7aS\",\"status\":\"affected\"},{\"version\":\"3.13.8S\",\"status\":\"affected\"},{\"version\":\"3.13.9S\",\"status\":\"affected\"},{\"version\":\"3.13.10S\",\"status\":\"affected\"},{\"version\":\"3.6.0E\",\"status\":\"affected\"},{\"version\":\"3.6.1E\",\"status\":\"affected\"},{\"version\":\"3.6.2aE\",\"status\":\"affected\"},{\"version\":\"3.6.2E\",\"status\":\"affected\"},{\"version\":\"3.6.3E\",\"status\":\"affected\"},{\"version\":\"3.6.4E\",\"status\":\"affected\"},{\"version\":\"3.6.5E\",\"status\":\"affected\"},{\"version\":\"3.6.6E\",\"status\":\"affected\"},{\"version\":\"3.6.5aE\",\"status\":\"affected\"},{\"version\":\"3.6.5bE\",\"status\":\"affected\"},{\"version\":\"3.6.7E\",\"status\":\"affected\"},{\"version\":\"3.6.8E\",\"status\":\"affected\"},{\"version\":\"3.6.7bE\",\"status\":\"affected\"},{\"version\":\"3.6.9E\",\"status\":\"affected\"},{\"version\":\"3.6.10E\",\"status\":\"affected\"},{\"version\":\"3.14.0S\",\"status\":\"affected\"},{\"version\":\"3.14.1S\",\"status\":\"affected\"},{\"version\":\"3.14.2S\",\"status\":\"affected\"},{\"version\":\"3.14.3S\",\"status\":\"affected\"},{\"version\":\"3.14.4S\",\"status\":\"affected\"},{\"version\":\"3.15.0S\",\"status\":\"affected\"},{\"version\":\"3.15.1S\",\"status\":\"affected\"},{\"version\":\"3.15.2S\",\"status\":\"affected\"},{\"version\":\"3.15.1cS\",\"status\":\"affected\"},{\"version\":\"3.15.3S\",\"status\":\"affected\"},{\"version\":\"3.15.4S\",\"status\":\"affected\"},{\"version\":\"3.16.0S\",\"status\":\"affected\"},{\"version\":\"3.16.1S\",\"status\":\"affected\"},{\"version\":\"3.16.1aS\",\"status\":\"affected\"},{\"version\":\"3.16.2S\",\"status\":\"affected\"},{\"version\":\"3.16.2aS\",\"status\":\"affected\"},{\"version\":\"3.16.0cS\",\"status\":\"affected\"},{\"version\":\"3.16.3S\",\"status\":\"affected\"},{\"version\":\"3.16.2bS\",\"status\":\"affected\"},{\"version\":\"3.16.3aS\",\"status\":\"affected\"},{\"version\":\"3.16.4S\",\"status\":\"affected\"},{\"version\":\"3.16.4aS\",\"status\":\"affected\"},{\"version\":\"3.16.4bS\",\"status\":\"affected\"},{\"version\":\"3.16.5S\",\"status\":\"affected\"},{\"version\":\"3.16.4dS\",\"status\":\"affected\"},{\"version\":\"3.16.6S\",\"status\":\"affected\"},{\"version\":\"3.16.7S\",\"status\":\"affected\"},{\"version\":\"3.16.6bS\",\"status\":\"affected\"},{\"version\":\"3.16.7aS\",\"status\":\"affected\"},{\"version\":\"3.16.7bS\",\"status\":\"affected\"},{\"version\":\"3.16.8S\",\"status\":\"affected\"},{\"version\":\"3.16.9S\",\"status\":\"affected\"},{\"version\":\"3.16.10S\",\"status\":\"affected\"},{\"version\":\"3.17.0S\",\"status\":\"affected\"},{\"version\":\"3.17.1S\",\"status\":\"affected\"},{\"version\":\"3.17.2S\",\"status\":\"affected\"},{\"version\":\"3.17.1aS\",\"status\":\"affected\"},{\"version\":\"3.17.3S\",\"status\":\"affected\"},{\"version\":\"3.17.4S\",\"status\":\"affected\"},{\"version\":\"16.1.1\",\"status\":\"affected\"},{\"version\":\"16.1.2\",\"status\":\"affected\"},{\"version\":\"16.1.3\",\"status\":\"affected\"},{\"version\":\"16.2.1\",\"status\":\"affected\"},{\"version\":\"16.2.2\",\"status\":\"affected\"},{\"version\":\"3.8.0E\",\"status\":\"affected\"},{\"version\":\"3.8.1E\",\"status\":\"affected\"},{\"version\":\"3.8.2E\",\"status\":\"affected\"},{\"version\":\"3.8.3E\",\"status\":\"affected\"},{\"version\":\"3.8.4E\",\"status\":\"affected\"},{\"version\":\"3.8.5E\",\"status\":\"affected\"},{\"version\":\"3.8.5aE\",\"status\":\"affected\"},{\"version\":\"3.8.6E\",\"status\":\"affected\"},{\"version\":\"3.8.7E\",\"status\":\"affected\"},{\"version\":\"3.8.8E\",\"status\":\"affected\"},{\"version\":\"3.8.9E\",\"status\":\"affected\"},{\"version\":\"3.8.10E\",\"status\":\"affected\"},{\"version\":\"16.3.1\",\"status\":\"affected\"},{\"version\":\"16.3.2\",\"status\":\"affected\"},{\"version\":\"16.3.3\",\"status\":\"affected\"},{\"version\":\"16.3.1a\",\"status\":\"affected\"},{\"version\":\"16.3.4\",\"status\":\"affected\"},{\"version\":\"16.3.5\",\"status\":\"affected\"},{\"version\":\"16.3.5b\",\"status\":\"affected\"},{\"version\":\"16.3.6\",\"status\":\"affected\"},{\"version\":\"16.3.7\",\"status\":\"affected\"},{\"version\":\"16.3.8\",\"status\":\"affected\"},{\"version\":\"16.3.9\",\"status\":\"affected\"},{\"version\":\"16.3.10\",\"status\":\"affected\"},{\"version\":\"16.3.11\",\"status\":\"affected\"},{\"version\":\"16.4.1\",\"status\":\"affected\"},{\"version\":\"16.4.2\",\"status\":\"affected\"},{\"version\":\"16.4.3\",\"status\":\"affected\"},{\"version\":\"16.5.1\",\"status\":\"affected\"},{\"version\":\"16.5.1a\",\"status\":\"affected\"},{\"version\":\"16.5.1b\",\"status\":\"affected\"},{\"version\":\"16.5.2\",\"status\":\"affected\"},{\"version\":\"16.5.3\",\"status\":\"affected\"},{\"version\":\"3.18.0aS\",\"status\":\"affected\"},{\"version\":\"3.18.0S\",\"status\":\"affected\"},{\"version\":\"3.18.1S\",\"status\":\"affected\"},{\"version\":\"3.18.2S\",\"status\":\"affected\"},{\"version\":\"3.18.3S\",\"status\":\"affected\"},{\"version\":\"3.18.4S\",\"status\":\"affected\"},{\"version\":\"3.18.0SP\",\"status\":\"affected\"},{\"version\":\"3.18.1SP\",\"status\":\"affected\"},{\"version\":\"3.18.1aSP\",\"status\":\"affected\"},{\"version\":\"3.18.1bSP\",\"status\":\"affected\"},{\"version\":\"3.18.1cSP\",\"status\":\"affected\"},{\"version\":\"3.18.2SP\",\"status\":\"affected\"},{\"version\":\"3.18.2aSP\",\"status\":\"affected\"},{\"version\":\"3.18.3SP\",\"status\":\"affected\"},{\"version\":\"3.18.4SP\",\"status\":\"affected\"},{\"version\":\"3.18.3aSP\",\"status\":\"affected\"},{\"version\":\"3.18.3bSP\",\"status\":\"affected\"},{\"version\":\"3.18.5SP\",\"status\":\"affected\"},{\"version\":\"3.18.6SP\",\"status\":\"affected\"},{\"version\":\"3.18.7SP\",\"status\":\"affected\"},{\"version\":\"3.18.8aSP\",\"status\":\"affected\"},{\"version\":\"3.18.9SP\",\"status\":\"affected\"},{\"version\":\"3.9.0E\",\"status\":\"affected\"},{\"version\":\"3.9.1E\",\"status\":\"affected\"},{\"version\":\"3.9.2E\",\"status\":\"affected\"},{\"version\":\"16.6.1\",\"status\":\"affected\"},{\"version\":\"16.6.2\",\"status\":\"affected\"},{\"version\":\"16.6.3\",\"status\":\"affected\"},{\"version\":\"16.6.4\",\"status\":\"affected\"},{\"version\":\"16.6.5\",\"status\":\"affected\"},{\"version\":\"16.6.4a\",\"status\":\"affected\"},{\"version\":\"16.6.5a\",\"status\":\"affected\"},{\"version\":\"16.6.6\",\"status\":\"affected\"},{\"version\":\"16.6.7\",\"status\":\"affected\"},{\"version\":\"16.6.8\",\"status\":\"affected\"},{\"version\":\"16.6.9\",\"status\":\"affected\"},{\"version\":\"16.6.10\",\"status\":\"affected\"},{\"version\":\"16.7.1\",\"status\":\"affected\"},{\"version\":\"16.7.1a\",\"status\":\"affected\"},{\"version\":\"16.7.1b\",\"status\":\"affected\"},{\"version\":\"16.7.2\",\"status\":\"affected\"},{\"version\":\"16.7.3\",\"status\":\"affected\"},{\"version\":\"16.7.4\",\"status\":\"affected\"},{\"version\":\"16.8.1\",\"status\":\"affected\"},{\"version\":\"16.8.1a\",\"status\":\"affected\"},{\"version\":\"16.8.1b\",\"status\":\"affected\"},{\"version\":\"16.8.1s\",\"status\":\"affected\"},{\"version\":\"16.8.1c\",\"status\":\"affected\"},{\"version\":\"16.8.1d\",\"status\":\"affected\"},{\"version\":\"16.8.2\",\"status\":\"affected\"},{\"version\":\"16.8.1e\",\"status\":\"affected\"},{\"version\":\"16.8.3\",\"status\":\"affected\"},{\"version\":\"16.9.1\",\"status\":\"affected\"},{\"version\":\"16.9.2\",\"status\":\"affected\"},{\"version\":\"16.9.1a\",\"status\":\"affected\"},{\"version\":\"16.9.1b\",\"status\":\"affected\"},{\"version\":\"16.9.1s\",\"status\":\"affected\"},{\"version\":\"16.9.3\",\"status\":\"affected\"},{\"version\":\"16.9.4\",\"status\":\"affected\"},{\"version\":\"16.9.3a\",\"status\":\"affected\"},{\"version\":\"16.9.5\",\"status\":\"affected\"},{\"version\":\"16.9.5f\",\"status\":\"affected\"},{\"version\":\"16.9.6\",\"status\":\"affected\"},{\"version\":\"16.9.7\",\"status\":\"affected\"},{\"version\":\"16.9.8\",\"status\":\"affected\"},{\"version\":\"16.10.1\",\"status\":\"affected\"},{\"version\":\"16.10.1a\",\"status\":\"affected\"},{\"version\":\"16.10.1b\",\"status\":\"affected\"},{\"version\":\"16.10.1s\",\"status\":\"affected\"},{\"version\":\"16.10.1c\",\"status\":\"affected\"},{\"version\":\"16.10.1e\",\"status\":\"affected\"},{\"version\":\"16.10.1d\",\"status\":\"affected\"},{\"version\":\"16.10.2\",\"status\":\"affected\"},{\"version\":\"16.10.1f\",\"status\":\"affected\"},{\"version\":\"16.10.1g\",\"status\":\"affected\"},{\"version\":\"16.10.3\",\"status\":\"affected\"},{\"version\":\"3.10.0E\",\"status\":\"affected\"},{\"version\":\"3.10.1E\",\"status\":\"affected\"},{\"version\":\"3.10.0cE\",\"status\":\"affected\"},{\"version\":\"3.10.2E\",\"status\":\"affected\"},{\"version\":\"3.10.3E\",\"status\":\"affected\"},{\"version\":\"16.11.1\",\"status\":\"affected\"},{\"version\":\"16.11.1a\",\"status\":\"affected\"},{\"version\":\"16.11.1b\",\"status\":\"affected\"},{\"version\":\"16.11.2\",\"status\":\"affected\"},{\"version\":\"16.11.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1\",\"status\":\"affected\"},{\"version\":\"16.12.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1a\",\"status\":\"affected\"},{\"version\":\"16.12.1c\",\"status\":\"affected\"},{\"version\":\"16.12.1w\",\"status\":\"affected\"},{\"version\":\"16.12.2\",\"status\":\"affected\"},{\"version\":\"16.12.1y\",\"status\":\"affected\"},{\"version\":\"16.12.2a\",\"status\":\"affected\"},{\"version\":\"16.12.3\",\"status\":\"affected\"},{\"version\":\"16.12.8\",\"status\":\"affected\"},{\"version\":\"16.12.2s\",\"status\":\"affected\"},{\"version\":\"16.12.1x\",\"status\":\"affected\"},{\"version\":\"16.12.1t\",\"status\":\"affected\"},{\"version\":\"16.12.4\",\"status\":\"affected\"},{\"version\":\"16.12.3s\",\"status\":\"affected\"},{\"version\":\"16.12.3a\",\"status\":\"affected\"},{\"version\":\"16.12.4a\",\"status\":\"affected\"},{\"version\":\"16.12.5\",\"status\":\"affected\"},{\"version\":\"16.12.6\",\"status\":\"affected\"},{\"version\":\"16.12.1z1\",\"status\":\"affected\"},{\"version\":\"16.12.5a\",\"status\":\"affected\"},{\"version\":\"16.12.5b\",\"status\":\"affected\"},{\"version\":\"16.12.1z2\",\"status\":\"affected\"},{\"version\":\"16.12.6a\",\"status\":\"affected\"},{\"version\":\"16.12.7\",\"status\":\"affected\"},{\"version\":\"16.12.9\",\"status\":\"affected\"},{\"version\":\"3.11.0E\",\"status\":\"affected\"},{\"version\":\"3.11.1E\",\"status\":\"affected\"},{\"version\":\"3.11.2E\",\"status\":\"affected\"},{\"version\":\"3.11.3E\",\"status\":\"affected\"},{\"version\":\"3.11.1aE\",\"status\":\"affected\"},{\"version\":\"3.11.4E\",\"status\":\"affected\"},{\"version\":\"3.11.3aE\",\"status\":\"affected\"},{\"version\":\"3.11.5E\",\"status\":\"affected\"},{\"version\":\"3.11.6E\",\"status\":\"affected\"},{\"version\":\"3.11.7E\",\"status\":\"affected\"},{\"version\":\"3.11.8E\",\"status\":\"affected\"},{\"version\":\"17.1.1\",\"status\":\"affected\"},{\"version\":\"17.1.1a\",\"status\":\"affected\"},{\"version\":\"17.1.1s\",\"status\":\"affected\"},{\"version\":\"17.1.1t\",\"status\":\"affected\"},{\"version\":\"17.1.3\",\"status\":\"affected\"},{\"version\":\"17.2.1\",\"status\":\"affected\"},{\"version\":\"17.2.1r\",\"status\":\"affected\"},{\"version\":\"17.2.1a\",\"status\":\"affected\"},{\"version\":\"17.2.1v\",\"status\":\"affected\"},{\"version\":\"17.2.2\",\"status\":\"affected\"},{\"version\":\"17.2.3\",\"status\":\"affected\"},{\"version\":\"17.3.1\",\"status\":\"affected\"},{\"version\":\"17.3.2\",\"status\":\"affected\"},{\"version\":\"17.3.3\",\"status\":\"affected\"},{\"version\":\"17.3.1a\",\"status\":\"affected\"},{\"version\":\"17.3.1w\",\"status\":\"affected\"},{\"version\":\"17.3.2a\",\"status\":\"affected\"},{\"version\":\"17.3.1x\",\"status\":\"affected\"},{\"version\":\"17.3.1z\",\"status\":\"affected\"},{\"version\":\"17.3.4\",\"status\":\"affected\"},{\"version\":\"17.3.5\",\"status\":\"affected\"},{\"version\":\"17.3.4a\",\"status\":\"affected\"},{\"version\":\"17.3.6\",\"status\":\"affected\"},{\"version\":\"17.3.4b\",\"status\":\"affected\"},{\"version\":\"17.3.4c\",\"status\":\"affected\"},{\"version\":\"17.3.5a\",\"status\":\"affected\"},{\"version\":\"17.3.5b\",\"status\":\"affected\"},{\"version\":\"17.3.7\",\"status\":\"affected\"},{\"version\":\"17.4.1\",\"status\":\"affected\"},{\"version\":\"17.4.2\",\"status\":\"affected\"},{\"version\":\"17.4.1a\",\"status\":\"affected\"},{\"version\":\"17.4.1b\",\"status\":\"affected\"},{\"version\":\"17.4.2a\",\"status\":\"affected\"},{\"version\":\"17.5.1\",\"status\":\"affected\"},{\"version\":\"17.5.1a\",\"status\":\"affected\"},{\"version\":\"17.5.1c\",\"status\":\"affected\"},{\"version\":\"17.6.1\",\"status\":\"affected\"},{\"version\":\"17.6.2\",\"status\":\"affected\"},{\"version\":\"17.6.1w\",\"status\":\"affected\"},{\"version\":\"17.6.1a\",\"status\":\"affected\"},{\"version\":\"17.6.1x\",\"status\":\"affected\"},{\"version\":\"17.6.3\",\"status\":\"affected\"},{\"version\":\"17.6.1y\",\"status\":\"affected\"},{\"version\":\"17.6.1z\",\"status\":\"affected\"},{\"version\":\"17.6.3a\",\"status\":\"affected\"},{\"version\":\"17.6.4\",\"status\":\"affected\"},{\"version\":\"17.6.1z1\",\"status\":\"affected\"},{\"version\":\"17.6.5\",\"status\":\"affected\"},{\"version\":\"17.6.5a\",\"status\":\"affected\"},{\"version\":\"17.7.1\",\"status\":\"affected\"},{\"version\":\"17.7.1a\",\"status\":\"affected\"},{\"version\":\"17.7.1b\",\"status\":\"affected\"},{\"version\":\"17.7.2\",\"status\":\"affected\"},{\"version\":\"17.10.1\",\"status\":\"affected\"},{\"version\":\"17.10.1a\",\"status\":\"affected\"},{\"version\":\"17.10.1b\",\"status\":\"affected\"},{\"version\":\"17.8.1\",\"status\":\"affected\"},{\"version\":\"17.8.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1\",\"status\":\"affected\"},{\"version\":\"17.9.1w\",\"status\":\"affected\"},{\"version\":\"17.9.2\",\"status\":\"affected\"},{\"version\":\"17.9.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1x\",\"status\":\"affected\"},{\"version\":\"17.9.1y\",\"status\":\"affected\"},{\"version\":\"17.9.3\",\"status\":\"affected\"},{\"version\":\"17.9.2a\",\"status\":\"affected\"},{\"version\":\"17.9.1x1\",\"status\":\"affected\"},{\"version\":\"17.9.3a\",\"status\":\"affected\"},{\"version\":\"17.9.1y1\",\"status\":\"affected\"},{\"version\":\"17.11.1\",\"status\":\"affected\"},{\"version\":\"17.11.1a\",\"status\":\"affected\"},{\"version\":\"17.11.99SW\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.\r\n\r This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details [\"#details\"] section of this advisory.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "Cisco discovered attempted exploitation of the GET VPN feature and conducted a technical code review of the feature. This vulnerability was discovered during our internal investigation. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Out-of-bounds Write\",\"type\":\"cwe\",\"cweId\":\"CWE-787\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-20109:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "sourcePath": "retained:/originalText", "text": "Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-20109:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "sourcePath": "retained:/sourceAction", "text": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "bounded", "truncatedFields": [ "/containers/cna/affected/0/versions", "/containers/cna/affected/0", "/containers/cna/affected/1/versions" ], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "modifiedAt": "2023-10-10T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:36.370Z", "fetchedAt": "2026-10-24T05:26:38.319Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-10-10T00:00:00.000Z", "fetchedAt": "2026-10-24T05:17:49.363Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "IOS / Cisco IOS XE Softwareにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T05:26:38.319Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "50478559c838f3796de39aeddbd7c5e4e3b1b4917bab9e819b72de9f56d3f674", "sourceModifiedAt": "2025-10-21T23:05:36.370Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco IOS および IOS XE の GET VPN 機能において、Group Domain of Interpretation (GDOI) と G‑IKEv2 プロトコルの属性検証が不十分であるため、認証されたリモート攻撃者がグループメンバーまたはキーサーバーの管理権限を取得すると、任意のコードを実行させるか、デバイスをクラッシュさせることができる。", "risk": "攻撃が成功すると、攻撃者はデバイス上で任意のコードを実行でき、システムを完全に制御できるか、リロードさせてサービス停止（DoS）状態になる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されたリモート攻撃者が、グループメンバーまたはキーサーバーの管理権限を持ち、GET VPN の GDOI および G‑IKEv2 プロトコルで属性検証が不十分な設定が存在する環境。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Cisco / IOS。影響ありとして記載：12.4(24)T。影響ありとして記載：12.4(24)T3。影響ありとして記載：12.4(22)T1。影響ありとして記載：12.4(24)T5。影響ありとして記載：12.4(24)T4。影響ありとして記載：12.4(22)T。影響ありとして記載：12.4(24)T8。影響ありとして記載：12.4(24)T2。影響ありとして記載：12.4(22)T5。影響ありとして記載：12.4(22)T4。影響ありとして記載：12.4(24)T1。影響ありとして記載：12.4(24)T7。影響ありとして記載：12.4(22)T3。影響ありとして記載：12.4(24)T6。影響ありとして記載：12.4(22)T2。影響ありとして記載：12.4(24)T4a。影響ありとして記載：12.4(24)T4b。影響ありとして記載：12.4(24)T3e。影響ありとして記載：12.4(24)T4c。影響ありとして記載：12.4(24)T4d。影響ありとして記載：12.4(24)T4e。影響ありとして記載：12.4(24)T3f。影響ありとして記載：12.4(24)T4f。影響ありとして記載：12.4(24)T4l。影響ありとして記載：12.4(24)MD1。影響ありとして記載：12.4(24)MD。影響ありとして記載：12.4(24)MD3。影響ありとして記載：12.4(24)MD2。影響ありとして記載：12.4(22)MD1。影響ありとして記載：12.4(22)MD2。影響ありとして記載：12.4(24)MD5。影響ありとして記載：12.4(22)MD。影響ありとして記載：12.4(24)MD4。影響ありとして記載：12.4(24)MD6。影響ありとして記載：12.4(24)MD7。影響ありとして記載：12.4(22)XR5。影響ありとして記載：12.4(22)XR4。影響ありとして記載：12.4(22)XR7。影響ありとして記載：12.4(22)XR2。影響ありとして記載：12.4(22)XR6。影響ありとして記載：12.4(22)XR10。影響ありとして記載：12.4(22)XR1。影響ありとして記載：12.4(22)XR9。影響ありとして記載：12.4(22)XR3。影響ありとして記載：12.4(22)XR8。影響ありとして記載：12.4(22)XR11。影響ありとして記載：12.4(22)XR12。影響ありとして記載：12.4(22)MDA3。影響ありとして記載：12.4(24)MDA5。影響ありとして記載：12.4(22)MDA5。影響ありとして記載：12.4(24)MDA3。影響ありとして記載：12.4(22)MDA4。影響ありとして記載：12.4(24)MDA4。影響ありとして記載：12.4(24)MDA1。影響ありとして記載：12.4(22)MDA。影響ありとして記載：12.4(22)MDA2。影響ありとして記載：12.4(22)MDA1。影響ありとして記載：12.4(24)MDA2。影響ありとして記載：12.4(22)MDA6。影響ありとして記載：12.4(24)MDA6。影響ありとして記載：12.4(24)MDA7。影響ありとして記載：12.4(24)MDA8。影響ありとして記載：12.4(24)MDA10。影響ありとして記載：12.4(24)MDA9。影響ありとして記載：12.4(24)MDA11。影響ありとして記載：12.4(24)MDA12。影響ありとして記載：12.4(24)MDA13。影響ありとして記載：12.4(24)YG3。影響ありとして記載：12.4(24)YG4。影響ありとして記載：12.4(24)YG1。影響ありとして記載：12.4(24)YG2。影響ありとして記載：12.4(24)YG。影響ありとして記載：15.0(1)M1。影響ありとして記載：15.0(1)M5。影響ありとして記載：15.0(1)M4。影響ありとして記載：15.0(1)M3。影響ありとして記載：15.0(1)M2。影響ありとして記載：15.0(1)M6。影響ありとして記載：15.0(1)M。影響ありとして記載：15.0(1)M7。影響ありとして記載：15.0(1)M10。影響ありとして記載：15.0(1)M9。影響ありとして記載：15.0(1)M8。影響ありとして記載：15.0(1)XA2。影響ありとして記載：15.0(1)XA4。影響ありとして記載：15.0(1)XA1。影響ありとして記載：15.0(1)XA3。影響ありとして記載：15.0(1)XA。影響ありとして記載：15.0(1)XA5。影響ありとして記載：15.1(2)T。影響ありとして記載：15.1(1)T4。影響ありとして記載：15.1(3)T2。影響ありとして記載：15.1(1)T1。影響ありとして記載：15.1(2)T0a。影響ありとして記載：15.1(3)T3。影響ありとして記載：15.1(1)T3。影響ありとして記載：15.1(2)T3。影響ありとして記載：15.1(2)T4。影響ありとして記載：15.1(1)T2。影響ありとして記載：15.1(3)T。影響ありとして記載：15.1(2)T2a。影響ありとして記載：15.1(3)T1。影響ありとして記載：15.1(1)T。影響ありとして記載：15.1(2)T2。影響ありとして記載：15.1(2)T1。影響ありとして記載：15.1(2)T5。影響ありとして記載：15.1(3)T4。影響ありとして記載：15.1(1)T5。影響ありとして記載：15.1(1)XB。影響ありとして記載：15.0(1)S2。影響ありとして記載：15.0(1)S1。影響ありとして記載：15.0(1)S。影響ありとして記載：15.0(1)S3a。影響ありとして記載：15.0(1)S4。影響ありとして記載：15.0(1)S5。影響ありとして記載：15.0(1)S4a。影響ありとして記載：15.0(1)S6。影響ありとして記載：15.2(1)S。影響ありとして記載：15.2(2)S。影響ありとして記載：15.2(1)S1。影響ありとして記載：15.2(4)S。影響ありとして記載：15.2(1)S2。影響ありとして記載：15.2(2)S1。影響ありとして記載：15.2(2)S2。影響ありとして記載：15.2(2)S0a。影響ありとして記載：15.2(2)S0c。影響ありとして記載：15.2(4)S1。影響ありとして記載：15.2(4)S4。影響ありとして記載：15.2(4)S6。影響ありとして記載：15.2(4)S2。影響ありとして記載：15.2(4)S5。影響ありとして記載：15.2(4)S3。影響ありとして記載：15.2(4)S3a。影響ありとして記載：15.2(4)S4a。影響ありとして記載：15.2(4)S7。影響ありとして記載：15.3(1)T。影響ありとして記載：15.3(2)T。影響ありとして記載：15.3(1)T1。影響ありとして記載：15.3(1)T2。影響ありとして記載：15.3(1)T3。影響ありとして記載：15.3(1)T4。影響ありとして記載：15.3(2)T1。影響ありとして記載：15.3(2)T2。影響ありとして記載：15.3(2)T3。影響ありとして記載：15.3(2)T4。影響ありとして記載：15.0(2)EY。影響ありとして記載：15.0(2)EY1。影響ありとして記載：15.0(2)EY2。影響ありとして記載：15.0(2)EY3。影響ありとして記載：15.1(2)S。影響ありとして記載：15.1(1)S。影響ありとして記載：15.1(1)S1。影響ありとして記載：15.1(3)S。影響ありとして記載：15.1(1)S2。影響ありとして記載：15.1(2)S1。影響ありとして記載：15.1(2)S2。影響ありとして記載：15.1(3)S1。影響ありとして記載：15.1(3)S0a。影響ありとして記載：15.1(3)S2。影響ありとして記載：15.1(3)S4。影響ありとして記載：15.1(3)S3。影響ありとして記載：15.1(3)S5。影響ありとして記載：15.1(3)S6。影響ありとして記載：15.1(3)S5a。影響ありとして記載：15.1(4)M3。影響ありとして記載：15.1(4)M。影響ありとして記載：15.1(4)M1。影響ありとして記載：15.1(4)M2。影響ありとして記載：15.1(4)M6。影響ありとして記載：15.1(4)M5。影響ありとして記載：15.1(4)M4。影響ありとして記載：15.1(4)M7。影響ありとして記載：15.1(4)M3a。影響ありとして記載：15.1(4)M10。影響ありとして記載：15.1(4)M8。影響ありとして記載：15.1(4)M9。影響ありとして記載：15.0(2)SE。影響ありとして記載：15.0(2)SE1。影響ありとして記載：15.0(2)SE2。影響ありとして記載：15.0(2)SE3。影響ありとして記載：15.0(2)SE4。影響ありとして記載：15.0(2)SE5。影響ありとして記載：15.0(2)SE6。影響ありとして記載：15.0(2)SE7。影響ありとして記載：15.0(2)SE8。影響ありとして記載：15.0(2)SE9。影響ありとして記載：15.0(2)SE10。影響ありとして記載：15.0(2)SE11。影響ありとして記載：15.0(2)SE10a。影響ありとして記載：15.0(2)SE12。影響ありとして記載：15.0(2)SE13。影響ありとして記載：15.1(2)GC。影響ありとして記載：15.1(2)GC1。影響ありとして記載：15.1(2)GC2。影響ありとして記載：15.1(4)GC。影響ありとして記載：15.1(4)GC1。影響ありとして記載：15.1(4)GC2。影響ありとして記載：15.1(1)SG。影響ありとして記載：15.1(2)SG。影響ありとして記載：15.1(1)SG1。影響ありとして記載：15.1(1)SG2。影響ありとして記載：15.1(2)SG1。影響ありとして記載：15.1(2)SG2。影響ありとして記載：15.1(2)SG3。影響ありとして記載：15.1(2)SG4。影響ありとして記載：15.1(2)SG5。影響ありとして記載：15.1(2)SG6。影響ありとして記載：15.1(2)SG7。影響ありとして記載：15.1(2)SG8。影響ありとして記載：15.0(1)MR。影響ありとして記載：15.0(2)MR。影響ありとして記載：15.2(4)M。影響ありとして記載：15.2(4)M1。影響ありとして記載：15.2(4)M2。影響ありとして記載：15.2(4)M4。影響ありとして記載：15.2(4)M3。影響ありとして記載：15.2(4)M5。影響ありとして記載：15.2(4)M8。影響ありとして記載：15.2(4)M10。影響ありとして記載：15.2(4)M7。影響ありとして記載：15.2(4)M6。影響ありとして記載：15.2(4)M9。影響ありとして記載：15.2(4)M6a。影響ありとして記載：15.2(4)M11。影響ありとして記載：12.4(24)MDB。影響ありとして記載：12.4(24)MDB1。影響ありとして記載：12.4(24)MDB3。影響ありとして記載：12.4(24)MDB4。影響ありとして記載：12.4(24)MDB5。影響ありとして記載：12.4(24)MDB6。影響ありとして記載：12.4(24)MDB7。影響ありとして記載：12.4(24)MDB5a。影響ありとして記載：12.4(24)MDB8。影響ありとして記載：12.4(24)MDB9。影響ありとして記載：12.4(24)MDB10。影響ありとして記載：12.4(24)MDB11。影響ありとして記載：12.4(24)MDB12。影響ありとして記載：12.4(24)MDB13。影響ありとして記載：12.4(24)MDB14。影響ありとして記載：12.4(24)MDB15。影響ありとして記載：12.4(24)MDB16。影響ありとして記載：12.4(24)MDB17。影響ありとして記載：12.4(24)MDB18。影響ありとして記載：12.4(24)MDB19。影響ありとして記載：15.0(2)EX。影響ありとして記載：15.0(2)EX1。影響ありとして記載：15.0(2)EX2。影響ありとして記載：15.0(2)EX3。影響ありとして記載：15.0(2)EX4。影響ありとして記載：15.0(2)EX5。影響ありとして記載：15.0(2)EX8。影響ありとして記載：15.0(2a)EX5。影響ありとして記載：15.0(2)EX10。影響ありとして記載：15.0(2)EX11。影響ありとして記載：15.0(2)EX13。影響ありとして記載：15.0(2)EX12。影響ありとして記載：15.2(1)GC。影響ありとして記載：15.2(1)GC1。影響ありとして記載：15.2(1)GC2。影響ありとして記載：15.2(2)GC。影響ありとして記載：15.2(3)GC。影響ありとして記載：15.2(3)GC1。影響ありとして記載：15.2(4)GC。影響ありとして記載：15.2(4)GC1。影響ありとして記載：15.2(4)GC2。影響ありとして記載：15.2(4)GC3。影響ありとして記載：15.1(1)SY。影響ありとして記載：15.1(1)SY1。影響ありとして記載：15.1(2)SY。影響ありとして記載：15.1(2)SY1。影響ありとして記載：15.1(2)SY2。影響ありとして記載：15.1(1)SY2。影響ありとして記載：15.1(1)SY3。影響ありとして記載：15.1(2)SY3。影響ありとして記載：15.1(1)SY4。影響ありとして記載：15.1(2)SY4。影響ありとして記載：15.1(1)SY5。影響ありとして記載：15.1(2)SY5。影響ありとして記載：15.1(2)SY4a。影響ありとして記載：15.1(1)SY6。影響ありとして記載：15.1(2)SY6。影響ありとして記載：15.1(2)SY7。影響ありとして記載：15.1(2)SY8。影響ありとして記載：15.1(2)SY9。影響ありとして記載：15.1(2)SY10。影響ありとして記載：15.1(2)SY11。影響ありとして記載：15.1(2)SY12。影響ありとして記載：15.1(2)SY13。影響ありとして記載：15.1(2)SY14。影響ありとして記載：15.1(2)SY15。影響ありとして記載：15.1(2)SY16。影響ありとして記載：15.3(1)S。影響ありとして記載：15.3(2)S。影響ありとして記載：15.3(3)S。影響ありとして記載：15.3(1)S2。影響ありとして記載：15.3(1)S1。影響ありとして記載：15.3(2)S2。影響ありとして記載：15.3(2)S1。影響ありとして記載：15.3(3)S1。影響ありとして記載：15.3(3)S2。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Cisco / Cisco IOS XE Software。影響ありとして記載：3.7.0S。影響ありとして記載：3.7.1S。影響ありとして記載：3.7.2S。影響ありとして記載：3.7.3S。影響ありとして記載：3.7.4S。影響ありとして記載：3.7.5S。影響ありとして記載：3.7.6S。影響ありとして記載：3.7.7S。影響ありとして記載：3.7.4aS。影響ありとして記載：3.7.2tS。影響ありとして記載：3.7.0bS。影響ありとして記載：3.7.1aS。影響ありとして記載：3.3.0SG。影響ありとして記載：3.3.2SG。影響ありとして記載：3.3.1SG。影響ありとして記載：3.8.0S。影響ありとして記載：3.8.1S。影響ありとして記載：3.8.2S。影響ありとして記載：3.9.1S。影響ありとして記載：3.9.0S。影響ありとして記載：3.9.2S。影響ありとして記載：3.9.1aS。影響ありとして記載：3.9.0aS。影響ありとして記載：3.4.0SG。影響ありとして記載：3.4.2SG。影響ありとして記載：3.4.1SG。影響ありとして記載：3.4.3SG。影響ありとして記載：3.4.4SG。影響ありとして記載：3.4.5SG。影響ありとして記載：3.4.6SG。影響ありとして記載：3.4.7SG。影響ありとして記載：3.4.8SG。影響ありとして記載：3.5.0E。影響ありとして記載：3.5.1E。影響ありとして記載：3.5.2E。影響ありとして記載：3.5.3E。影響ありとして記載：3.10.0S。影響ありとして記載：3.10.1S。影響ありとして記載：3.10.2S。影響ありとして記載：3.10.3S。影響ありとして記載：3.10.4S。影響ありとして記載：3.10.5S。影響ありとして記載：3.10.6S。影響ありとして記載：3.10.2tS。影響ありとして記載：3.10.7S。影響ありとして記載：3.10.1xbS。影響ありとして記載：3.10.8S。影響ありとして記載：3.10.8aS。影響ありとして記載：3.10.9S。影響ありとして記載：3.10.10S。影響ありとして記載：3.11.1S。影響ありとして記載：3.11.2S。影響ありとして記載：3.11.0S。影響ありとして記載：3.11.3S。影響ありとして記載：3.11.4S。影響ありとして記載：3.12.0S。影響ありとして記載：3.12.1S。影響ありとして記載：3.12.2S。影響ありとして記載：3.12.3S。影響ありとして記載：3.12.0aS。影響ありとして記載：3.12.4S。影響ありとして記載：3.13.0S。影響ありとして記載：3.13.1S。影響ありとして記載：3.13.2S。影響ありとして記載：3.13.3S。影響ありとして記載：3.13.4S。影響ありとして記載：3.13.5S。影響ありとして記載：3.13.2aS。影響ありとして記載：3.13.0aS。影響ありとして記載：3.13.5aS。影響ありとして記載：3.13.6S。影響ありとして記載：3.13.7S。影響ありとして記載：3.13.6aS。影響ありとして記載：3.13.7aS。影響ありとして記載：3.13.8S。影響ありとして記載：3.13.9S。影響ありとして記載：3.13.10S。影響ありとして記載：3.6.0E。影響ありとして記載：3.6.1E。影響ありとして記載：3.6.2aE。影響ありとして記載：3.6.2E。影響ありとして記載：3.6.3E。影響ありとして記載：3.6.4E。影響ありとして記載：3.6.5E。影響ありとして記載：3.6.6E。影響ありとして記載：3.6.5aE。影響ありとして記載：3.6.5bE。影響ありとして記載：3.6.7E。影響ありとして記載：3.6.8E。影響ありとして記載：3.6.7bE。影響ありとして記載：3.6.9E。影響ありとして記載：3.6.10E。影響ありとして記載：3.14.0S。影響ありとして記載：3.14.1S。影響ありとして記載：3.14.2S。影響ありとして記載：3.14.3S。影響ありとして記載：3.14.4S。影響ありとして記載：3.15.0S。影響ありとして記載：3.15.1S。影響ありとして記載：3.15.2S。影響ありとして記載：3.15.1cS。影響ありとして記載：3.15.3S。影響ありとして記載：3.15.4S。影響ありとして記載：3.16.0S。影響ありとして記載：3.16.1S。影響ありとして記載：3.16.1aS。影響ありとして記載：3.16.2S。影響ありとして記載：3.16.2aS。影響ありとして記載：3.16.0cS。影響ありとして記載：3.16.3S。影響ありとして記載：3.16.2bS。影響ありとして記載：3.16.3aS。影響ありとして記載：3.16.4S。影響ありとして記載：3.16.4aS。影響ありとして記載：3.16.4bS。影響ありとして記載：3.16.5S。影響ありとして記載：3.16.4dS。影響ありとして記載：3.16.6S。影響ありとして記載：3.16.7S。影響ありとして記載：3.16.6bS。影響ありとして記載：3.16.7aS。影響ありとして記載：3.16.7bS。影響ありとして記載：3.16.8S。影響ありとして記載：3.16.9S。影響ありとして記載：3.16.10S。影響ありとして記載：3.17.0S。影響ありとして記載：3.17.1S。影響ありとして記載：3.17.2S。影響ありとして記載：3.17.1aS。影響ありとして記載：3.17.3S。影響ありとして記載：3.17.4S。影響ありとして記載：16.1.1。影響ありとして記載：16.1.2。影響ありとして記載：16.1.3。影響ありとして記載：16.2.1。影響ありとして記載：16.2.2。影響ありとして記載：3.8.0E。影響ありとして記載：3.8.1E。影響ありとして記載：3.8.2E。影響ありとして記載：3.8.3E。影響ありとして記載：3.8.4E。影響ありとして記載：3.8.5E。影響ありとして記載：3.8.5aE。影響ありとして記載：3.8.6E。影響ありとして記載：3.8.7E。影響ありとして記載：3.8.8E。影響ありとして記載：3.8.9E。影響ありとして記載：3.8.10E。影響ありとして記載：16.3.1。影響ありとして記載：16.3.2。影響ありとして記載：16.3.3。影響ありとして記載：16.3.1a。影響ありとして記載：16.3.4。影響ありとして記載：16.3.5。影響ありとして記載：16.3.5b。影響ありとして記載：16.3.6。影響ありとして記載：16.3.7。影響ありとして記載：16.3.8。影響ありとして記載：16.3.9。影響ありとして記載：16.3.10。影響ありとして記載：16.3.11。影響ありとして記載：16.4.1。影響ありとして記載：16.4.2。影響ありとして記載：16.4.3。影響ありとして記載：16.5.1。影響ありとして記載：16.5.1a。影響ありとして記載：16.5.1b。影響ありとして記載：16.5.2。影響ありとして記載：16.5.3。影響ありとして記載：3.18.0aS。影響ありとして記載：3.18.0S。影響ありとして記載：3.18.1S。影響ありとして記載：3.18.2S。影響ありとして記載：3.18.3S。影響ありとして記載：3.18.4S。影響ありとして記載：3.18.0SP。影響ありとして記載：3.18.1SP。影響ありとして記載：3.18.1aSP。影響ありとして記載：3.18.1bSP。影響ありとして記載：3.18.1cSP。影響ありとして記載：3.18.2SP。影響ありとして記載：3.18.2aSP。影響ありとして記載：3.18.3SP。影響ありとして記載：3.18.4SP。影響ありとして記載：3.18.3aSP。影響ありとして記載：3.18.3bSP。影響ありとして記載：3.18.5SP。影響ありとして記載：3.18.6SP。影響ありとして記載：3.18.7SP。影響ありとして記載：3.18.8aSP。影響ありとして記載：3.18.9SP。影響ありとして記載：3.9.0E。影響ありとして記載：3.9.1E。影響ありとして記載：3.9.2E。影響ありとして記載：16.6.1。影響ありとして記載：16.6.2。影響ありとして記載：16.6.3。影響ありとして記載：16.6.4。影響ありとして記載：16.6.5。影響ありとして記載：16.6.4a。影響ありとして記載：16.6.5a。影響ありとして記載：16.6.6。影響ありとして記載：16.6.7。影響ありとして記載：16.6.8。影響ありとして記載：16.6.9。影響ありとして記載：16.6.10。影響ありとして記載：16.7.1。影響ありとして記載：16.7.1a。影響ありとして記載：16.7.1b。影響ありとして記載：16.7.2。影響ありとして記載：16.7.3。影響ありとして記載：16.7.4。影響ありとして記載：16.8.1。影響ありとして記載：16.8.1a。影響ありとして記載：16.8.1b。影響ありとして記載：16.8.1s。影響ありとして記載：16.8.1c。影響ありとして記載：16.8.1d。影響ありとして記載：16.8.2。影響ありとして記載：16.8.1e。影響ありとして記載：16.8.3。影響ありとして記載：16.9.1。影響ありとして記載：16.9.2。影響ありとして記載：16.9.1a。影響ありとして記載：16.9.1b。影響ありとして記載：16.9.1s。影響ありとして記載：16.9.3。影響ありとして記載：16.9.4。影響ありとして記載：16.9.3a。影響ありとして記載：16.9.5。影響ありとして記載：16.9.5f。影響ありとして記載：16.9.6。影響ありとして記載：16.9.7。影響ありとして記載：16.9.8。影響ありとして記載：16.10.1。影響ありとして記載：16.10.1a。影響ありとして記載：16.10.1b。影響ありとして記載：16.10.1s。影響ありとして記載：16.10.1c。影響ありとして記載：16.10.1e。影響ありとして記載：16.10.1d。影響ありとして記載：16.10.2。影響ありとして記載：16.10.1f。影響ありとして記載：16.10.1g。影響ありとして記載：16.10.3。影響ありとして記載：3.10.0E。影響ありとして記載：3.10.1E。影響ありとして記載：3.10.0cE。影響ありとして記載：3.10.2E。影響ありとして記載：3.10.3E。影響ありとして記載：16.11.1。影響ありとして記載：16.11.1a。影響ありとして記載：16.11.1b。影響ありとして記載：16.11.2。影響ありとして記載：16.11.1s。影響ありとして記載：16.12.1。影響ありとして記載：16.12.1s。影響ありとして記載：16.12.1a。影響ありとして記載：16.12.1c。影響ありとして記載：16.12.1w。影響ありとして記載：16.12.2。影響ありとして記載：16.12.1y。影響ありとして記載：16.12.2a。影響ありとして記載：16.12.3。影響ありとして記載：16.12.8。影響ありとして記載：16.12.2s。影響ありとして記載：16.12.1x。影響ありとして記載：16.12.1t。影響ありとして記載：16.12.4。影響ありとして記載：16.12.3s。影響ありとして記載：16.12.3a。影響ありとして記載：16.12.4a。影響ありとして記載：16.12.5。影響ありとして記載：16.12.6。影響ありとして記載：16.12.1z1。影響ありとして記載：16.12.5a。影響ありとして記載：16.12.5b。影響ありとして記載：16.12.1z2。影響ありとして記載：16.12.6a。影響ありとして記載：16.12.7。影響ありとして記載：16.12.9。影響ありとして記載：3.11.0E。影響ありとして記載：3.11.1E。影響ありとして記載：3.11.2E。影響ありとして記載：3.11.3E。影響ありとして記載：3.11.1aE。影響ありとして記載：3.11.4E。影響ありとして記載：3.11.3aE。影響ありとして記載：3.11.5E。影響ありとして記載：3.11.6E。影響ありとして記載：3.11.7E。影響ありとして記載：3.11.8E。影響ありとして記載：17.1.1。影響ありとして記載：17.1.1a。影響ありとして記載：17.1.1s。影響ありとして記載：17.1.1t。影響ありとして記載：17.1.3。影響ありとして記載：17.2.1。影響ありとして記載：17.2.1r。影響ありとして記載：17.2.1a。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json" ], "evidenceIds": [ "E2" ] }, { "text": "「IOS / Cisco IOS XE Software」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-20109", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "https://nvd.nist.gov/vuln/detail/CVE-2023-20109" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "ベンダーの指示に従って緩和策を適用するか、緩和策が利用できない場合は製品の使用を中止する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109" ], "evidenceIds": [ "E4", "E5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-20109", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "https://nvd.nist.gov/vuln/detail/CVE-2023-20109" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。", "長い公式資料の一部を使って解説しています。対象製品・版・構成の全一覧は、併記した構造化データも管理担当者と照合してください。", "公式資料が長いため、取得できた一部の内容に基づく説明です。対象の版・例外・構成条件が省略されている可能性があるため、取得範囲だけで対象外とは判断しないでください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-20109", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20109", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.\r\n\r This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details [\"#details\"] section of this advisory.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"IOS\",\"versions\":[{\"version\":\"12.4(24)T\",\"status\":\"affected\"},{\"version\":\"12.4(24)T3\",\"status\":\"affected\"},{\"version\":\"12.4(22)T1\",\"status\":\"affected\"},{\"version\":\"12.4(24)T5\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4\",\"status\":\"affected\"},{\"version\":\"12.4(22)T\",\"status\":\"affected\"},{\"version\":\"12.4(24)T8\",\"status\":\"affected\"},{\"version\":\"12.4(24)T2\",\"status\":\"affected\"},{\"version\":\"12.4(22)T5\",\"status\":\"affected\"},{\"version\":\"12.4(22)T4\",\"status\":\"affected\"},{\"version\":\"12.4(24)T1\",\"status\":\"affected\"},{\"version\":\"12.4(24)T7\",\"status\":\"affected\"},{\"version\":\"12.4(22)T3\",\"status\":\"affected\"},{\"version\":\"12.4(24)T6\",\"status\":\"affected\"},{\"version\":\"12.4(22)T2\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4a\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4b\",\"status\":\"affected\"},{\"version\":\"12.4(24)T3e\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4c\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4d\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4e\",\"status\":\"affected\"},{\"version\":\"12.4(24)T3f\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4f\",\"status\":\"affected\"},{\"version\":\"12.4(24)T4l\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD1\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD3\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD2\",\"status\":\"affected\"},{\"version\":\"12.4(22)MD1\",\"status\":\"affected\"},{\"version\":\"12.4(22)MD2\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD5\",\"status\":\"affected\"},{\"version\":\"12.4(22)MD\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD4\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD6\",\"status\":\"affected\"},{\"version\":\"12.4(24)MD7\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR5\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR4\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR7\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR2\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR6\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR10\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR1\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR9\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR3\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR8\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR11\",\"status\":\"affected\"},{\"version\":\"12.4(22)XR12\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA3\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA5\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA5\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA3\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA4\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA4\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA1\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA2\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA1\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA2\",\"status\":\"affected\"},{\"version\":\"12.4(22)MDA6\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA6\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA7\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA8\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA10\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA9\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA11\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA12\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDA13\",\"status\":\"affected\"},{\"version\":\"12.4(24)YG3\",\"status\":\"affected\"},{\"version\":\"12.4(24)YG4\",\"status\":\"affected\"},{\"version\":\"12.4(24)YG1\",\"status\":\"affected\"},{\"version\":\"12.4(24)YG2\",\"status\":\"affected\"},{\"version\":\"12.4(24)YG\",\"status\":\"affected\"},{\"version\":\"15.0(1)M1\",\"status\":\"affected\"},{\"version\":\"15.0(1)M5\",\"status\":\"affected\"},{\"version\":\"15.0(1)M4\",\"status\":\"affected\"},{\"version\":\"15.0(1)M3\",\"status\":\"affected\"},{\"version\":\"15.0(1)M2\",\"status\":\"affected\"},{\"version\":\"15.0(1)M6\",\"status\":\"affected\"},{\"version\":\"15.0(1)M\",\"status\":\"affected\"},{\"version\":\"15.0(1)M7\",\"status\":\"affected\"},{\"version\":\"15.0(1)M10\",\"status\":\"affected\"},{\"version\":\"15.0(1)M9\",\"status\":\"affected\"},{\"version\":\"15.0(1)M8\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA2\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA4\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA1\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA3\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA\",\"status\":\"affected\"},{\"version\":\"15.0(1)XA5\",\"status\":\"affected\"},{\"version\":\"15.1(2)T\",\"status\":\"affected\"},{\"version\":\"15.1(1)T4\",\"status\":\"affected\"},{\"version\":\"15.1(3)T2\",\"status\":\"affected\"},{\"version\":\"15.1(1)T1\",\"status\":\"affected\"},{\"version\":\"15.1(2)T0a\",\"status\":\"affected\"},{\"version\":\"15.1(3)T3\",\"status\":\"affected\"},{\"version\":\"15.1(1)T3\",\"status\":\"affected\"},{\"version\":\"15.1(2)T3\",\"status\":\"affected\"},{\"version\":\"15.1(2)T4\",\"status\":\"affected\"},{\"version\":\"15.1(1)T2\",\"status\":\"affected\"},{\"version\":\"15.1(3)T\",\"status\":\"affected\"},{\"version\":\"15.1(2)T2a\",\"status\":\"affected\"},{\"version\":\"15.1(3)T1\",\"status\":\"affected\"},{\"version\":\"15.1(1)T\",\"status\":\"affected\"},{\"version\":\"15.1(2)T2\",\"status\":\"affected\"},{\"version\":\"15.1(2)T1\",\"status\":\"affected\"},{\"version\":\"15.1(2)T5\",\"status\":\"affected\"},{\"version\":\"15.1(3)T4\",\"status\":\"affected\"},{\"version\":\"15.1(1)T5\",\"status\":\"affected\"},{\"version\":\"15.1(1)XB\",\"status\":\"affected\"},{\"version\":\"15.0(1)S2\",\"status\":\"affected\"},{\"version\":\"15.0(1)S1\",\"status\":\"affected\"},{\"version\":\"15.0(1)S\",\"status\":\"affected\"},{\"version\":\"15.0(1)S3a\",\"status\":\"affected\"},{\"version\":\"15.0(1)S4\",\"status\":\"affected\"},{\"version\":\"15.0(1)S5\",\"status\":\"affected\"},{\"version\":\"15.0(1)S4a\",\"status\":\"affected\"},{\"version\":\"15.0(1)S6\",\"status\":\"affected\"},{\"version\":\"15.2(1)S\",\"status\":\"affected\"},{\"version\":\"15.2(2)S\",\"status\":\"affected\"},{\"version\":\"15.2(1)S1\",\"status\":\"affected\"},{\"version\":\"15.2(4)S\",\"status\":\"affected\"},{\"version\":\"15.2(1)S2\",\"status\":\"affected\"},{\"version\":\"15.2(2)S1\",\"status\":\"affected\"},{\"version\":\"15.2(2)S2\",\"status\":\"affected\"},{\"version\":\"15.2(2)S0a\",\"status\":\"affected\"},{\"version\":\"15.2(2)S0c\",\"status\":\"affected\"},{\"version\":\"15.2(4)S1\",\"status\":\"affected\"},{\"version\":\"15.2(4)S4\",\"status\":\"affected\"},{\"version\":\"15.2(4)S6\",\"status\":\"affected\"},{\"version\":\"15.2(4)S2\",\"status\":\"affected\"},{\"version\":\"15.2(4)S5\",\"status\":\"affected\"},{\"version\":\"15.2(4)S3\",\"status\":\"affected\"},{\"version\":\"15.2(4)S3a\",\"status\":\"affected\"},{\"version\":\"15.2(4)S4a\",\"status\":\"affected\"},{\"version\":\"15.2(4)S7\",\"status\":\"affected\"},{\"version\":\"15.3(1)T\",\"status\":\"affected\"},{\"version\":\"15.3(2)T\",\"status\":\"affected\"},{\"version\":\"15.3(1)T1\",\"status\":\"affected\"},{\"version\":\"15.3(1)T2\",\"status\":\"affected\"},{\"version\":\"15.3(1)T3\",\"status\":\"affected\"},{\"version\":\"15.3(1)T4\",\"status\":\"affected\"},{\"version\":\"15.3(2)T1\",\"status\":\"affected\"},{\"version\":\"15.3(2)T2\",\"status\":\"affected\"},{\"version\":\"15.3(2)T3\",\"status\":\"affected\"},{\"version\":\"15.3(2)T4\",\"status\":\"affected\"},{\"version\":\"15.0(2)EY\",\"status\":\"affected\"},{\"version\":\"15.0(2)EY1\",\"status\":\"affected\"},{\"version\":\"15.0(2)EY2\",\"status\":\"affected\"},{\"version\":\"15.0(2)EY3\",\"status\":\"affected\"},{\"version\":\"15.1(2)S\",\"status\":\"affected\"},{\"version\":\"15.1(1)S\",\"status\":\"affected\"},{\"version\":\"15.1(1)S1\",\"status\":\"affected\"},{\"version\":\"15.1(3)S\",\"status\":\"affected\"},{\"version\":\"15.1(1)S2\",\"status\":\"affected\"},{\"version\":\"15.1(2)S1\",\"status\":\"affected\"},{\"version\":\"15.1(2)S2\",\"status\":\"affected\"},{\"version\":\"15.1(3)S1\",\"status\":\"affected\"},{\"version\":\"15.1(3)S0a\",\"status\":\"affected\"},{\"version\":\"15.1(3)S2\",\"status\":\"affected\"},{\"version\":\"15.1(3)S4\",\"status\":\"affected\"},{\"version\":\"15.1(3)S3\",\"status\":\"affected\"},{\"version\":\"15.1(3)S5\",\"status\":\"affected\"},{\"version\":\"15.1(3)S6\",\"status\":\"affected\"},{\"version\":\"15.1(3)S5a\",\"status\":\"affected\"},{\"version\":\"15.1(4)M3\",\"status\":\"affected\"},{\"version\":\"15.1(4)M\",\"status\":\"affected\"},{\"version\":\"15.1(4)M1\",\"status\":\"affected\"},{\"version\":\"15.1(4)M2\",\"status\":\"affected\"},{\"version\":\"15.1(4)M6\",\"status\":\"affected\"},{\"version\":\"15.1(4)M5\",\"status\":\"affected\"},{\"version\":\"15.1(4)M4\",\"status\":\"affected\"},{\"version\":\"15.1(4)M7\",\"status\":\"affected\"},{\"version\":\"15.1(4)M3a\",\"status\":\"affected\"},{\"version\":\"15.1(4)M10\",\"status\":\"affected\"},{\"version\":\"15.1(4)M8\",\"status\":\"affected\"},{\"version\":\"15.1(4)M9\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE1\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE2\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE3\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE4\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE5\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE6\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE7\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE8\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE9\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE10\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE11\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE10a\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE12\",\"status\":\"affected\"},{\"version\":\"15.0(2)SE13\",\"status\":\"affected\"},{\"version\":\"15.1(2)GC\",\"status\":\"affected\"},{\"version\":\"15.1(2)GC1\",\"status\":\"affected\"},{\"version\":\"15.1(2)GC2\",\"status\":\"affected\"},{\"version\":\"15.1(4)GC\",\"status\":\"affected\"},{\"version\":\"15.1(4)GC1\",\"status\":\"affected\"},{\"version\":\"15.1(4)GC2\",\"status\":\"affected\"},{\"version\":\"15.1(1)SG\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG\",\"status\":\"affected\"},{\"version\":\"15.1(1)SG1\",\"status\":\"affected\"},{\"version\":\"15.1(1)SG2\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG1\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG2\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG3\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG4\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG5\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG6\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG7\",\"status\":\"affected\"},{\"version\":\"15.1(2)SG8\",\"status\":\"affected\"},{\"version\":\"15.0(1)MR\",\"status\":\"affected\"},{\"version\":\"15.0(2)MR\",\"status\":\"affected\"},{\"version\":\"15.2(4)M\",\"status\":\"affected\"},{\"version\":\"15.2(4)M1\",\"status\":\"affected\"},{\"version\":\"15.2(4)M2\",\"status\":\"affected\"},{\"version\":\"15.2(4)M4\",\"status\":\"affected\"},{\"version\":\"15.2(4)M3\",\"status\":\"affected\"},{\"version\":\"15.2(4)M5\",\"status\":\"affected\"},{\"version\":\"15.2(4)M8\",\"status\":\"affected\"},{\"version\":\"15.2(4)M10\",\"status\":\"affected\"},{\"version\":\"15.2(4)M7\",\"status\":\"affected\"},{\"version\":\"15.2(4)M6\",\"status\":\"affected\"},{\"version\":\"15.2(4)M9\",\"status\":\"affected\"},{\"version\":\"15.2(4)M6a\",\"status\":\"affected\"},{\"version\":\"15.2(4)M11\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB1\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB3\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB4\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB5\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB6\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB7\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB5a\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB8\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB9\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB10\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB11\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB12\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB13\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB14\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB15\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB16\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB17\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB18\",\"status\":\"affected\"},{\"version\":\"12.4(24)MDB19\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX1\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX2\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX3\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX4\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX5\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX8\",\"status\":\"affected\"},{\"version\":\"15.0(2a)EX5\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX10\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX11\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX13\",\"status\":\"affected\"},{\"version\":\"15.0(2)EX12\",\"status\":\"affected\"},{\"version\":\"15.2(1)GC\",\"status\":\"affected\"},{\"version\":\"15.2(1)GC1\",\"status\":\"affected\"},{\"version\":\"15.2(1)GC2\",\"status\":\"affected\"},{\"version\":\"15.2(2)GC\",\"status\":\"affected\"},{\"version\":\"15.2(3)GC\",\"status\":\"affected\"},{\"version\":\"15.2(3)GC1\",\"status\":\"affected\"},{\"version\":\"15.2(4)GC\",\"status\":\"affected\"},{\"version\":\"15.2(4)GC1\",\"status\":\"affected\"},{\"version\":\"15.2(4)GC2\",\"status\":\"affected\"},{\"version\":\"15.2(4)GC3\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY1\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY1\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY2\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY2\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY3\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY3\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY4\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY4\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY5\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY5\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY4a\",\"status\":\"affected\"},{\"version\":\"15.1(1)SY6\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY6\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY7\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY8\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY9\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY10\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY11\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY12\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY13\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY14\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY15\",\"status\":\"affected\"},{\"version\":\"15.1(2)SY16\",\"status\":\"affected\"},{\"version\":\"15.3(1)S\",\"status\":\"affected\"},{\"version\":\"15.3(2)S\",\"status\":\"affected\"},{\"version\":\"15.3(3)S\",\"status\":\"affected\"},{\"version\":\"15.3(1)S2\",\"status\":\"affected\"},{\"version\":\"15.3(1)S1\",\"status\":\"affected\"},{\"version\":\"15.3(2)S2\",\"status\":\"affected\"},{\"version\":\"15.3(2)S1\",\"status\":\"affected\"},{\"version\":\"15.3(3)S1\",\"status\":\"affected\"},{\"version\":\"15.3(3)S2\",\"status\":\"affected\"},{\"version\":\"15.3(3)S3\",\"status\":\"affected\"},{\"version\":\"15.3(3)S6\",\"status\":\"affected\"},{\"version\":\"15.3(3)S4\",\"status\":\"affected\"},{\"version\":\"15.3(3)S1a\",\"status\":\"affected\"},{\"version\":\"15.3(3)S5\",\"status\":\"affected\"},{\"version\":\"15.3(3)S7\",\"status\":\"affected\"},{\"version\":\"15.3(3)S8\",\"status\":\"affected\"},{\"version\":\"15.3(3)S9\",\"status\":\"affected\"},{\"version\":\"15.3(3)S10\",\"status\":\"affected\"},{\"version\":\"15.3(3)S8a\",\"status\":\"affected\"},{\"version\":\"15.4(1)T\",\"status\":\"affected\"},{\"version\":\"15.4(2)T\",\"status\":\"affected\"},{\"version\":\"15.4(1)T2\",\"status\":\"affected\"},{\"version\":\"15.4(1)T1\",\"status\":\"affected\"},{\"version\":\"15.4(1)T3\",\"status\":\"affected\"},{\"version\":\"15.4(2)T1\",\"status\":\"affected\"},{\"version\":\"15.4(2)T3\",\"status\":\"affected\"},{\"version\":\"15.4(2)T2\",\"status\":\"affected\"},{\"version\":\"15.4(1)T4\",\"status\":\"affected\"},{\"version\":\"15.4(2)T4\",\"status\":\"affected\"},{\"version\":\"15.0(2)EA\",\"status\":\"affected\"},{\"version\":\"15.0(2)EA1\",\"status\":\"affected\"},{\"version\":\"15.2(1)E\",\"status\":\"affected\"},{\"version\":\"15.2(2)E\",\"status\":\"affected\"},{\"version\":\"15.2(1)E1\",\"status\":\"affected\"},{\"version\":\"15.2(3)E\",\"status\":\"affected\"},{\"version\":\"15.2(1)E2\",\"status\":\"affected\"},{\"version\":\"15.2(1)E3\",\"status\":\"affected\"},{\"version\":\"15.2(2)E1\",\"status\":\"affected\"},{\"version\":\"15.2(4)E\",\"status\":\"affected\"},{\"version\":\"15.2(3)E1\",\"status\":\"affected\"},{\"version\":\"15.2(2)E2\",\"status\":\"affected\"},{\"version\":\"15.2(2a)E1\",\"status\":\"affected\"},{\"version\":\"15.2(2)E3\",\"status\":\"affected\"},{\"version\":\"15.2(2a)E2\",\"status\":\"affected\"},{\"version\":\"15.2(3)E2\",\"status\":\"affected\"},{\"version\":\"15.2(3a)E\",\"status\":\"affected\"},{\"version\":\"15.2(3)E3\",\"status\":\"affected\"},{\"version\":\"15.2(4)E1\",\"status\":\"affected\"},{\"version\":\"15.2(2)E4\",\"status\":\"affected\"},{\"version\":\"15.2(2)E5\",\"status\":\"affected\"},{\"version\":\"15.2(4)E2\",\"status\":\"affected\"},{\"version\":\"15.2(3)E4\",\"status\":\"affected\"},{\"version\":\"15.2(5)E\",\"status\":\"affected\"},{\"version\":\"15.2(4)E3\",\"status\":\"affected\"},{\"version\":\"15.2(2)E6\",\"status\":\"affected\"},{\"version\":\"15.2(5a)E\",\"status\":\"affected\"},{\"version\":\"15.2(5)E1\",\"status\":\"affected\"},{\"version\":\"15.2(5b)E\",\"status\":\"affected\"},{\"version\":\"15.2(2)E5a\",\"status\":\"affected\"},{\"version\":\"15.2(5c)E\",\"status\":\"affected\"},{\"version\":\"15.2(3)E5\",\"status\":\"affected\"},{\"version\":\"15.2(2)E5b\",\"status\":\"affected\"},{\"version\":\"15.2(5a)E1\",\"status\":\"affected\"},{\"version\":\"15.2(4)E4\",\"status\":\"affected\"},{\"version\":\"15.2(2)", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20109.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco IOS XE Software\",\"versions\":[{\"version\":\"3.7.0S\",\"status\":\"affected\"},{\"version\":\"3.7.1S\",\"status\":\"affected\"},{\"version\":\"3.7.2S\",\"status\":\"affected\"},{\"version\":\"3.7.3S\",\"status\":\"affected\"},{\"version\":\"3.7.4S\",\"status\":\"affected\"},{\"version\":\"3.7.5S\",\"status\":\"affected\"},{\"version\":\"3.7.6S\",\"status\":\"affected\"},{\"version\":\"3.7.7S\",\"status\":\"affected\"},{\"version\":\"3.7.4aS\",\"status\":\"affected\"},{\"version\":\"3.7.2tS\",\"status\":\"affected\"},{\"version\":\"3.7.0bS\",\"status\":\"affected\"},{\"version\":\"3.7.1aS\",\"status\":\"affected\"},{\"version\":\"3.3.0SG\",\"status\":\"affected\"},{\"version\":\"3.3.2SG\",\"status\":\"affected\"},{\"version\":\"3.3.1SG\",\"status\":\"affected\"},{\"version\":\"3.8.0S\",\"status\":\"affected\"},{\"version\":\"3.8.1S\",\"status\":\"affected\"},{\"version\":\"3.8.2S\",\"status\":\"affected\"},{\"version\":\"3.9.1S\",\"status\":\"affected\"},{\"version\":\"3.9.0S\",\"status\":\"affected\"},{\"version\":\"3.9.2S\",\"status\":\"affected\"},{\"version\":\"3.9.1aS\",\"status\":\"affected\"},{\"version\":\"3.9.0aS\",\"status\":\"affected\"},{\"version\":\"3.4.0SG\",\"status\":\"affected\"},{\"version\":\"3.4.2SG\",\"status\":\"affected\"},{\"version\":\"3.4.1SG\",\"status\":\"affected\"},{\"version\":\"3.4.3SG\",\"status\":\"affected\"},{\"version\":\"3.4.4SG\",\"status\":\"affected\"},{\"version\":\"3.4.5SG\",\"status\":\"affected\"},{\"version\":\"3.4.6SG\",\"status\":\"affected\"},{\"version\":\"3.4.7SG\",\"status\":\"affected\"},{\"version\":\"3.4.8SG\",\"status\":\"affected\"},{\"version\":\"3.5.0E\",\"status\":\"affected\"},{\"version\":\"3.5.1E\",\"status\":\"affected\"},{\"version\":\"3.5.2E\",\"status\":\"affected\"},{\"version\":\"3.5.3E\",\"status\":\"affected\"},{\"version\":\"3.10.0S\",\"status\":\"affected\"},{\"version\":\"3.10.1S\",\"status\":\"affected\"},{\"version\":\"3.10.2S\",\"status\":\"affected\"},{\"version\":\"3.10.3S\",\"status\":\"affected\"},{\"version\":\"3.10.4S\",\"status\":\"affected\"},{\"version\":\"3.10.5S\",\"status\":\"affected\"},{\"version\":\"3.10.6S\",\"status\":\"affected\"},{\"version\":\"3.10.2tS\",\"status\":\"affected\"},{\"version\":\"3.10.7S\",\"status\":\"affected\"},{\"version\":\"3.10.1xbS\",\"status\":\"affected\"},{\"version\":\"3.10.8S\",\"status\":\"affected\"},{\"version\":\"3.10.8aS\",\"status\":\"affected\"},{\"version\":\"3.10.9S\",\"status\":\"affected\"},{\"version\":\"3.10.10S\",\"status\":\"affected\"},{\"version\":\"3.11.1S\",\"status\":\"affected\"},{\"version\":\"3.11.2S\",\"status\":\"affected\"},{\"version\":\"3.11.0S\",\"status\":\"affected\"},{\"version\":\"3.11.3S\",\"status\":\"affected\"},{\"version\":\"3.11.4S\",\"status\":\"affected\"},{\"version\":\"3.12.0S\",\"status\":\"affected\"},{\"version\":\"3.12.1S\",\"status\":\"affected\"},{\"version\":\"3.12.2S\",\"status\":\"affected\"},{\"version\":\"3.12.3S\",\"status\":\"affected\"},{\"version\":\"3.12.0aS\",\"status\":\"affected\"},{\"version\":\"3.12.4S\",\"status\":\"affected\"},{\"version\":\"3.13.0S\",\"status\":\"affected\"},{\"version\":\"3.13.1S\",\"status\":\"affected\"},{\"version\":\"3.13.2S\",\"status\":\"affected\"},{\"version\":\"3.13.3S\",\"status\":\"affected\"},{\"version\":\"3.13.4S\",\"status\":\"affected\"},{\"version\":\"3.13.5S\",\"status\":\"affected\"},{\"version\":\"3.13.2aS\",\"status\":\"affected\"},{\"version\":\"3.13.0aS\",\"status\":\"affected\"},{\"version\":\"3.13.5aS\",\"status\":\"affected\"},{\"version\":\"3.13.6S\",\"status\":\"affected\"},{\"version\":\"3.13.7S\",\"status\":\"affected\"},{\"version\":\"3.13.6aS\",\"status\":\"affected\"},{\"version\":\"3.13.7aS\",\"status\":\"affected\"},{\"version\":\"3.13.8S\",\"status\":\"affected\"},{\"version\":\"3.13.9S\",\"status\":\"affected\"},{\"version\":\"3.13.10S\",\"status\":\"affected\"},{\"version\":\"3.6.0E\",\"status\":\"affected\"},{\"version\":\"3.6.1E\",\"status\":\"affected\"},{\"version\":\"3.6.2aE\",\"status\":\"affected\"},{\"version\":\"3.6.2E\",\"status\":\"affected\"},{\"version\":\"3.6.3E\",\"status\":\"affected\"},{\"version\":\"3.6.4E\",\"status\":\"affected\"},{\"version\":\"3.6.5E\",\"status\":\"affected\"},{\"version\":\"3.6.6E\",\"status\":\"affected\"},{\"version\":\"3.6.5aE\",\"status\":\"affected\"},{\"version\":\"3.6.5bE\",\"status\":\"affected\"},{\"version\":\"3.6.7E\",\"status\":\"affected\"},{\"version\":\"3.6.8E\",\"status\":\"affected\"},{\"version\":\"3.6.7bE\",\"status\":\"affected\"},{\"version\":\"3.6.9E\",\"status\":\"affected\"},{\"version\":\"3.6.10E\",\"status\":\"affected\"},{\"version\":\"3.14.0S\",\"status\":\"affected\"},{\"version\":\"3.14.1S\",\"status\":\"affected\"},{\"version\":\"3.14.2S\",\"status\":\"affected\"},{\"version\":\"3.14.3S\",\"status\":\"affected\"},{\"version\":\"3.14.4S\",\"status\":\"affected\"},{\"version\":\"3.15.0S\",\"status\":\"affected\"},{\"version\":\"3.15.1S\",\"status\":\"affected\"},{\"version\":\"3.15.2S\",\"status\":\"affected\"},{\"version\":\"3.15.1cS\",\"status\":\"affected\"},{\"version\":\"3.15.3S\",\"status\":\"affected\"},{\"version\":\"3.15.4S\",\"status\":\"affected\"},{\"version\":\"3.16.0S\",\"status\":\"affected\"},{\"version\":\"3.16.1S\",\"status\":\"affected\"},{\"version\":\"3.16.1aS\",\"status\":\"affected\"},{\"version\":\"3.16.2S\",\"status\":\"affected\"},{\"version\":\"3.16.2aS\",\"status\":\"affected\"},{\"version\":\"3.16.0cS\",\"status\":\"affected\"},{\"version\":\"3.16.3S\",\"status\":\"affected\"},{\"version\":\"3.16.2bS\",\"status\":\"affected\"},{\"version\":\"3.16.3aS\",\"status\":\"affected\"},{\"version\":\"3.16.4S\",\"status\":\"affected\"},{\"version\":\"3.16.4aS\",\"status\":\"affected\"},{\"version\":\"3.16.4bS\",\"status\":\"affected\"},{\"version\":\"3.16.5S\",\"status\":\"affected\"},{\"version\":\"3.16.4dS\",\"status\":\"affected\"},{\"version\":\"3.16.6S\",\"status\":\"affected\"},{\"version\":\"3.16.7S\",\"status\":\"affected\"},{\"version\":\"3.16.6bS\",\"status\":\"affected\"},{\"version\":\"3.16.7aS\",\"status\":\"affected\"},{\"version\":\"3.16.7bS\",\"status\":\"affected\"},{\"version\":\"3.16.8S\",\"status\":\"affected\"},{\"version\":\"3.16.9S\",\"status\":\"affected\"},{\"version\":\"3.16.10S\",\"status\":\"affected\"},{\"version\":\"3.17.0S\",\"status\":\"affected\"},{\"version\":\"3.17.1S\",\"status\":\"affected\"},{\"version\":\"3.17.2S\",\"status\":\"affected\"},{\"version\":\"3.17.1aS\",\"status\":\"affected\"},{\"version\":\"3.17.3S\",\"status\":\"affected\"},{\"version\":\"3.17.4S\",\"status\":\"affected\"},{\"version\":\"16.1.1\",\"status\":\"affected\"},{\"version\":\"16.1.2\",\"status\":\"affected\"},{\"version\":\"16.1.3\",\"status\":\"affected\"},{\"version\":\"16.2.1\",\"status\":\"affected\"},{\"version\":\"16.2.2\",\"status\":\"affected\"},{\"version\":\"3.8.0E\",\"status\":\"affected\"},{\"version\":\"3.8.1E\",\"status\":\"affected\"},{\"version\":\"3.8.2E\",\"status\":\"affected\"},{\"version\":\"3.8.3E\",\"status\":\"affected\"},{\"version\":\"3.8.4E\",\"status\":\"affected\"},{\"version\":\"3.8.5E\",\"status\":\"affected\"},{\"version\":\"3.8.5aE\",\"status\":\"affected\"},{\"version\":\"3.8.6E\",\"status\":\"affected\"},{\"version\":\"3.8.7E\",\"status\":\"affected\"},{\"version\":\"3.8.8E\",\"status\":\"affected\"},{\"version\":\"3.8.9E\",\"status\":\"affected\"},{\"version\":\"3.8.10E\",\"status\":\"affected\"},{\"version\":\"16.3.1\",\"status\":\"affected\"},{\"version\":\"16.3.2\",\"status\":\"affected\"},{\"version\":\"16.3.3\",\"status\":\"affected\"},{\"version\":\"16.3.1a\",\"status\":\"affected\"},{\"version\":\"16.3.4\",\"status\":\"affected\"},{\"version\":\"16.3.5\",\"status\":\"affected\"},{\"version\":\"16.3.5b\",\"status\":\"affected\"},{\"version\":\"16.3.6\",\"status\":\"affected\"},{\"version\":\"16.3.7\",\"status\":\"affected\"},{\"version\":\"16.3.8\",\"status\":\"affected\"},{\"version\":\"16.3.9\",\"status\":\"affected\"},{\"version\":\"16.3.10\",\"status\":\"affected\"},{\"version\":\"16.3.11\",\"status\":\"affected\"},{\"version\":\"16.4.1\",\"status\":\"affected\"},{\"version\":\"16.4.2\",\"status\":\"affected\"},{\"version\":\"16.4.3\",\"status\":\"affected\"},{\"version\":\"16.5.1\",\"status\":\"affected\"},{\"version\":\"16.5.1a\",\"status\":\"affected\"},{\"version\":\"16.5.1b\",\"status\":\"affected\"},{\"version\":\"16.5.2\",\"status\":\"affected\"},{\"version\":\"16.5.3\",\"status\":\"affected\"},{\"version\":\"3.18.0aS\",\"status\":\"affected\"},{\"version\":\"3.18.0S\",\"status\":\"affected\"},{\"version\":\"3.18.1S\",\"status\":\"affected\"},{\"version\":\"3.18.2S\",\"status\":\"affected\"},{\"version\":\"3.18.3S\",\"status\":\"affected\"},{\"version\":\"3.18.4S\",\"status\":\"affected\"},{\"version\":\"3.18.0SP\",\"status\":\"affected\"},{\"version\":\"3.18.1SP\",\"status\":\"affected\"},{\"version\":\"3.18.1aSP\",\"status\":\"affected\"},{\"version\":\"3.18.1bSP\",\"status\":\"affected\"},{\"version\":\"3.18.1cSP\",\"status\":\"affected\"},{\"version\":\"3.18.2SP\",\"status\":\"affected\"},{\"version\":\"3.18.2aSP\",\"status\":\"affected\"},{\"version\":\"3.18.3SP\",\"status\":\"affected\"},{\"version\":\"3.18.4SP\",\"status\":\"affected\"},{\"version\":\"3.18.3aSP\",\"status\":\"affected\"},{\"version\":\"3.18.3bSP\",\"status\":\"affected\"},{\"version\":\"3.18.5SP\",\"status\":\"affected\"},{\"version\":\"3.18.6SP\",\"status\":\"affected\"},{\"version\":\"3.18.7SP\",\"status\":\"affected\"},{\"version\":\"3.18.8aSP\",\"status\":\"affected\"},{\"version\":\"3.18.9SP\",\"status\":\"affected\"},{\"version\":\"3.9.0E\",\"status\":\"affected\"},{\"version\":\"3.9.1E\",\"status\":\"affected\"},{\"version\":\"3.9.2E\",\"status\":\"affected\"},{\"version\":\"16.6.1\",\"status\":\"affected\"},{\"version\":\"16.6.2\",\"status\":\"affected\"},{\"version\":\"16.6.3\",\"status\":\"affected\"},{\"version\":\"16.6.4\",\"status\":\"affected\"},{\"version\":\"16.6.5\",\"status\":\"affected\"},{\"version\":\"16.6.4a\",\"status\":\"affected\"},{\"version\":\"16.6.5a\",\"status\":\"affected\"},{\"version\":\"16.6.6\",\"status\":\"affected\"},{\"version\":\"16.6.7\",\"status\":\"affected\"},{\"version\":\"16.6.8\",\"status\":\"affected\"},{\"version\":\"16.6.9\",\"status\":\"affected\"},{\"version\":\"16.6.10\",\"status\":\"affected\"},{\"version\":\"16.7.1\",\"status\":\"affected\"},{\"version\":\"16.7.1a\",\"status\":\"affected\"},{\"version\":\"16.7.1b\",\"status\":\"affected\"},{\"version\":\"16.7.2\",\"status\":\"affected\"},{\"version\":\"16.7.3\",\"status\":\"affected\"},{\"version\":\"16.7.4\",\"status\":\"affected\"},{\"version\":\"16.8.1\",\"status\":\"affected\"},{\"version\":\"16.8.1a\",\"status\":\"affected\"},{\"version\":\"16.8.1b\",\"status\":\"affected\"},{\"version\":\"16.8.1s\",\"status\":\"affected\"},{\"version\":\"16.8.1c\",\"status\":\"affected\"},{\"version\":\"16.8.1d\",\"status\":\"affected\"},{\"version\":\"16.8.2\",\"status\":\"affected\"},{\"version\":\"16.8.1e\",\"status\":\"affected\"},{\"version\":\"16.8.3\",\"status\":\"affected\"},{\"version\":\"16.9.1\",\"status\":\"affected\"},{\"version\":\"16.9.2\",\"status\":\"affected\"},{\"version\":\"16.9.1a\",\"status\":\"affected\"},{\"version\":\"16.9.1b\",\"status\":\"affected\"},{\"version\":\"16.9.1s\",\"status\":\"affected\"},{\"version\":\"16.9.3\",\"status\":\"affected\"},{\"version\":\"16.9.4\",\"status\":\"affected\"},{\"version\":\"16.9.3a\",\"status\":\"affected\"},{\"version\":\"16.9.5\",\"status\":\"affected\"},{\"version\":\"16.9.5f\",\"status\":\"affected\"},{\"version\":\"16.9.6\",\"status\":\"affected\"},{\"version\":\"16.9.7\",\"status\":\"affected\"},{\"version\":\"16.9.8\",\"status\":\"affected\"},{\"version\":\"16.10.1\",\"status\":\"affected\"},{\"version\":\"16.10.1a\",\"status\":\"affected\"},{\"version\":\"16.10.1b\",\"status\":\"affected\"},{\"version\":\"16.10.1s\",\"status\":\"affected\"},{\"version\":\"16.10.1c\",\"status\":\"affected\"},{\"version\":\"16.10.1e\",\"status\":\"affected\"},{\"version\":\"16.10.1d\",\"status\":\"affected\"},{\"version\":\"16.10.2\",\"status\":\"affected\"},{\"version\":\"16.10.1f\",\"status\":\"affected\"},{\"version\":\"16.10.1g\",\"status\":\"affected\"},{\"version\":\"16.10.3\",\"status\":\"affected\"},{\"version\":\"3.10.0E\",\"status\":\"affected\"},{\"version\":\"3.10.1E\",\"status\":\"affected\"},{\"version\":\"3.10.0cE\",\"status\":\"affected\"},{\"version\":\"3.10.2E\",\"status\":\"affected\"},{\"version\":\"3.10.3E\",\"status\":\"affected\"},{\"version\":\"16.11.1\",\"status\":\"affected\"},{\"version\":\"16.11.1a\",\"status\":\"affected\"},{\"version\":\"16.11.1b\",\"status\":\"affected\"},{\"version\":\"16.11.2\",\"status\":\"affected\"},{\"version\":\"16.11.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1\",\"status\":\"affected\"},{\"version\":\"16.12.1s\",\"status\":\"affected\"},{\"version\":\"16.12.1a\",\"status\":\"affected\"},{\"version\":\"16.12.1c\",\"status\":\"affected\"},{\"version\":\"16.12.1w\",\"status\":\"affected\"},{\"version\":\"16.12.2\",\"status\":\"affected\"},{\"version\":\"16.12.1y\",\"status\":\"affected\"},{\"version\":\"16.12.2a\",\"status\":\"affected\"},{\"version\":\"16.12.3\",\"status\":\"affected\"},{\"version\":\"16.12.8\",\"status\":\"affected\"},{\"version\":\"16.12.2s\",\"status\":\"affected\"},{\"version\":\"16.12.1x\",\"status\":\"affected\"},{\"version\":\"16.12.1t\",\"status\":\"affected\"},{\"version\":\"16.12.4\",\"status\":\"affected\"},{\"version\":\"16.12.3s\",\"status\":\"affected\"},{\"version\":\"16.12.3a\",\"status\":\"affected\"},{\"version\":\"16.12.4a\",\"status\":\"affected\"},{\"version\":\"16.12.5\",\"status\":\"affected\"},{\"version\":\"16.12.6\",\"status\":\"affected\"},{\"version\":\"16.12.1z1\",\"status\":\"affected\"},{\"version\":\"16.12.5a\",\"status\":\"affected\"},{\"version\":\"16.12.5b\",\"status\":\"affected\"},{\"version\":\"16.12.1z2\",\"status\":\"affected\"},{\"version\":\"16.12.6a\",\"status\":\"affected\"},{\"version\":\"16.12.7\",\"status\":\"affected\"},{\"version\":\"16.12.9\",\"status\":\"affected\"},{\"version\":\"3.11.0E\",\"status\":\"affected\"},{\"version\":\"3.11.1E\",\"status\":\"affected\"},{\"version\":\"3.11.2E\",\"status\":\"affected\"},{\"version\":\"3.11.3E\",\"status\":\"affected\"},{\"version\":\"3.11.1aE\",\"status\":\"affected\"},{\"version\":\"3.11.4E\",\"status\":\"affected\"},{\"version\":\"3.11.3aE\",\"status\":\"affected\"},{\"version\":\"3.11.5E\",\"status\":\"affected\"},{\"version\":\"3.11.6E\",\"status\":\"affected\"},{\"version\":\"3.11.7E\",\"status\":\"affected\"},{\"version\":\"3.11.8E\",\"status\":\"affected\"},{\"version\":\"17.1.1\",\"status\":\"affected\"},{\"version\":\"17.1.1a\",\"status\":\"affected\"},{\"version\":\"17.1.1s\",\"status\":\"affected\"},{\"version\":\"17.1.1t\",\"status\":\"affected\"},{\"version\":\"17.1.3\",\"status\":\"affected\"},{\"version\":\"17.2.1\",\"status\":\"affected\"},{\"version\":\"17.2.1r\",\"status\":\"affected\"},{\"version\":\"17.2.1a\",\"status\":\"affected\"},{\"version\":\"17.2.1v\",\"status\":\"affected\"},{\"version\":\"17.2.2\",\"status\":\"affected\"},{\"version\":\"17.2.3\",\"status\":\"affected\"},{\"version\":\"17.3.1\",\"status\":\"affected\"},{\"version\":\"17.3.2\",\"status\":\"affected\"},{\"version\":\"17.3.3\",\"status\":\"affected\"},{\"version\":\"17.3.1a\",\"status\":\"affected\"},{\"version\":\"17.3.1w\",\"status\":\"affected\"},{\"version\":\"17.3.2a\",\"status\":\"affected\"},{\"version\":\"17.3.1x\",\"status\":\"affected\"},{\"version\":\"17.3.1z\",\"status\":\"affected\"},{\"version\":\"17.3.4\",\"status\":\"affected\"},{\"version\":\"17.3.5\",\"status\":\"affected\"},{\"version\":\"17.3.4a\",\"status\":\"affected\"},{\"version\":\"17.3.6\",\"status\":\"affected\"},{\"version\":\"17.3.4b\",\"status\":\"affected\"},{\"version\":\"17.3.4c\",\"status\":\"affected\"},{\"version\":\"17.3.5a\",\"status\":\"affected\"},{\"version\":\"17.3.5b\",\"status\":\"affected\"},{\"version\":\"17.3.7\",\"status\":\"affected\"},{\"version\":\"17.4.1\",\"status\":\"affected\"},{\"version\":\"17.4.2\",\"status\":\"affected\"},{\"version\":\"17.4.1a\",\"status\":\"affected\"},{\"version\":\"17.4.1b\",\"status\":\"affected\"},{\"version\":\"17.4.2a\",\"status\":\"affected\"},{\"version\":\"17.5.1\",\"status\":\"affected\"},{\"version\":\"17.5.1a\",\"status\":\"affected\"},{\"version\":\"17.5.1c\",\"status\":\"affected\"},{\"version\":\"17.6.1\",\"status\":\"affected\"},{\"version\":\"17.6.2\",\"status\":\"affected\"},{\"version\":\"17.6.1w\",\"status\":\"affected\"},{\"version\":\"17.6.1a\",\"status\":\"affected\"},{\"version\":\"17.6.1x\",\"status\":\"affected\"},{\"version\":\"17.6.3\",\"status\":\"affected\"},{\"version\":\"17.6.1y\",\"status\":\"affected\"},{\"version\":\"17.6.1z\",\"status\":\"affected\"},{\"version\":\"17.6.3a\",\"status\":\"affected\"},{\"version\":\"17.6.4\",\"status\":\"affected\"},{\"version\":\"17.6.1z1\",\"status\":\"affected\"},{\"version\":\"17.6.5\",\"status\":\"affected\"},{\"version\":\"17.6.5a\",\"status\":\"affected\"},{\"version\":\"17.7.1\",\"status\":\"affected\"},{\"version\":\"17.7.1a\",\"status\":\"affected\"},{\"version\":\"17.7.1b\",\"status\":\"affected\"},{\"version\":\"17.7.2\",\"status\":\"affected\"},{\"version\":\"17.10.1\",\"status\":\"affected\"},{\"version\":\"17.10.1a\",\"status\":\"affected\"},{\"version\":\"17.10.1b\",\"status\":\"affected\"},{\"version\":\"17.8.1\",\"status\":\"affected\"},{\"version\":\"17.8.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1\",\"status\":\"affected\"},{\"version\":\"17.9.1w\",\"status\":\"affected\"},{\"version\":\"17.9.2\",\"status\":\"affected\"},{\"version\":\"17.9.1a\",\"status\":\"affected\"},{\"version\":\"17.9.1x\",\"status\":\"affected\"},{\"version\":\"17.9.1y\",\"status\":\"affected\"},{\"version\":\"17.9.3\",\"status\":\"affected\"},{\"version\":\"17.9.2a\",\"status\":\"affected\"},{\"version\":\"17.9.1x1\",\"status\":\"affected\"},{\"version\":\"17.9.3a\",\"status\":\"affected\"},{\"version\":\"17.9.1y1\",\"status\":\"affected\"},{\"version\":\"17.11.1\",\"status\":\"affected\"},{\"version\":\"17.11.1a\",\"status\":\"affected\"},{\"version\":\"17.11.99SW\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "sourceField": "retained:/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "sourceField": "/sourceAction", "excerpt": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20109", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-20109\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-20109（IOS / Cisco IOS XE Software）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されたリモート攻撃者が、グループメンバーまたはキーサーバーの管理権限を持ち、GET VPN の GDOI および G‑IKEv2 プロトコルで属性検証が不十分な設定が存在する環境。\n・公式の対象表：Cisco / IOS。影響ありとして記載：12.4(24)T。影響ありとして記載：12.4(24)T3。影響ありとして記載：12.4(22)T1。影響ありとして記載：12.4(24)T5。影響ありとして記載：12.4(24)T4。影響ありとして記載：12.4(22)T。影響ありとして記載：12.4(24)T8。影響ありとして記載：12.4(24)T2。影響ありとして記載：12.4(22)T5。影響ありとして記載：12.4(22)T4。影響ありとして記載：12.4(24)T1。影響ありとして記載：12.4(24)T7。影響ありとして記載：12.4(22)T3。影響ありとして記載：12.4(24)T6。影響ありとして記載：12.4(22)T2。影響ありとして記載：12.4(24)T4a。影響ありとして記載：12.4(24)T4b。影響ありとして記載：12.4(24)T3e。影響ありとして記載：12.4(24)T4c。影響ありとして記載：12.4(24)T4d。影響ありとして記載：12.4(24)T4e。影響ありとして記載：12.4(24)T3f。影響ありとして記載：12.4(24)T4f。影響ありとして記載：12.4(24)T4l。影響ありとして記載：12.4(24)MD1。影響ありとして記載：12.4(24)MD。影響ありとして記載：12.4(24)MD3。影響ありとして記載：12.4(24)MD2。影響ありとして記載：12.4(22)MD1。影響ありとして記載：12.4(22)MD2。影響ありとして記載：12.4(24)MD5。影響ありとして記載：12.4(22)MD。影響ありとして記載：12.4(24)MD4。影響ありとして記載：12.4(24)MD6。影響ありとして記載：12.4(24)MD7。影響ありとして記載：12.4(22)XR5。影響ありとして記載：12.4(22)XR4。影響ありとして記載：12.4(22)XR7。影響ありとして記載：12.4(22)XR2。影響ありとして記載：12.4(22)XR6。影響ありとして記載：12.4(22)XR10。影響ありとして記載：12.4(22)XR1。影響ありとして記載：12.4(22)XR9。影響ありとして記載：12.4(22)XR3。影響ありとして記載：12.4(22)XR8。影響ありとして記載：12.4(22)XR11。影響ありとして記載：12.4(22)XR12。影響ありとして記載：12.4(22)MDA3。影響ありとして記載：12.4(24)MDA5。影響ありとして記載：12.4(22)MDA5。影響ありとして記載：12.4(24)MDA3。影響ありとして記載：12.4(22)MDA4。影響ありとして記載：12.4(24)MDA4。影響ありとして記載：12.4(24)MDA1。影響ありとして記載：12.4(22)MDA。影響ありとして記載：12.4(22)MDA2。影響ありとして記載：12.4(22)MDA1。影響ありとして記載：12.4(24)MDA2。影響ありとして記載：12.4(22)MDA6。影響ありとして記載：12.4(24)MDA6。影響ありとして記載：12.4(24)MDA7。影響ありとして記載：12.4(24)MDA8。影響ありとして記載：12.4(24)MDA10。影響ありとして記載：12.4(24)MDA9。影響ありとして記載：12.4(24)MDA11。影響ありとして記載：12.4(24)MDA12。影響ありとして記載：12.4(24)MDA13。影響ありとして記載：12.4(24)YG3。影響ありとして記載：12.4(24)YG4。影響ありとして記載：12.4(24)YG1。影響ありとして記載：12.4(24)YG2。影響ありとして記載：12.4(24)YG。影響ありとして記載：15.0(1)M1。影響ありとして記載：15.0(1)M5。影響ありとして記載：15.0(1)M4。影響ありとして記載：15.0(1)M3。影響ありとして記載：15.0(1)M2。影響ありとして記載：15.0(1)M6。影響ありとして記載：15.0(1)M。影響ありとして記載：15.0(1)M7。影響ありとして記載：15.0(1)M10。影響ありとして記載：15.0(1)M9。影響ありとして記載：15.0(1)M8。影響ありとして記載：15.0(1)XA2。影響ありとして記載：15.0(1)XA4。影響ありとして記載：15.0(1)XA1。影響ありとして記載：15.0(1)XA3。影響ありとして記載：15.0(1)XA。影響ありとして記載：15.0(1)XA5。影響ありとして記載：15.1(2)T。影響ありとして記載：15.1(1)T4。影響ありとして記載：15.1(3)T2。影響ありとして記載：15.1(1)T1。影響ありとして記載：15.1(2)T0a。影響ありとして記載：15.1(3)T3。影響ありとして記載：15.1(1)T3。影響ありとして記載：15.1(2)T3。影響ありとして記載：15.1(2)T4。影響ありとして記載：15.1(1)T2。影響ありとして記載：15.1(3)T。影響ありとして記載：15.1(2)T2a。影響ありとして記載：15.1(3)T1。影響ありとして記載：15.1(1)T。影響ありとして記載：15.1(2)T2。影響ありとして記載：15.1(2)T1。影響ありとして記載：15.1(2)T5。影響ありとして記載：15.1(3)T4。影響ありとして記載：15.1(1)T5。影響ありとして記載：15.1(1)XB。影響ありとして記載：15.0(1)S2。影響ありとして記載：15.0(1)S1。影響ありとして記載：15.0(1)S。影響ありとして記載：15.0(1)S3a。影響ありとして記載：15.0(1)S4。影響ありとして記載：15.0(1)S5。影響ありとして記載：15.0(1)S4a。影響ありとして記載：15.0(1)S6。影響ありとして記載：15.2(1)S。影響ありとして記載：15.2(2)S。影響ありとして記載：15.2(1)S1。影響ありとして記載：15.2(4)S。影響ありとして記載：15.2(1)S2。影響ありとして記載：15.2(2)S1。影響ありとして記載：15.2(2)S2。影響ありとして記載：15.2(2)S0a。影響ありとして記載：15.2(2)S0c。影響ありとして記載：15.2(4)S1。影響ありとして記載：15.2(4)S4。影響ありとして記載：15.2(4)S6。影響ありとして記載：15.2(4)S2。影響ありとして記載：15.2(4)S5。影響ありとして記載：15.2(4)S3。影響ありとして記載：15.2(4)S3a。影響ありとして記載：15.2(4)S4a。影響ありとして記載：15.2(4)S7。影響ありとして記載：15.3(1)T。影響ありとして記載：15.3(2)T。影響ありとして記載：15.3(1)T1。影響ありとして記載：15.3(1)T2。影響ありとして記載：15.3(1)T3。影響ありとして記載：15.3(1)T4。影響ありとして記載：15.3(2)T1。影響ありとして記載：15.3(2)T2。影響ありとして記載：15.3(2)T3。影響ありとして記載：15.3(2)T4。影響ありとして記載：15.0(2)EY。影響ありとして記載：15.0(2)EY1。影響ありとして記載：15.0(2)EY2。影響ありとして記載：15.0(2)EY3。影響ありとして記載：15.1(2)S。影響ありとして記載：15.1(1)S。影響ありとして記載：15.1(1)S1。影響ありとして記載：15.1(3)S。影響ありとして記載：15.1(1)S2。影響ありとして記載：15.1(2)S1。影響ありとして記載：15.1(2)S2。影響ありとして記載：15.1(3)S1。影響ありとして記載：15.1(3)S0a。影響ありとして記載：15.1(3)S2。影響ありとして記載：15.1(3)S4。影響ありとして記載：15.1(3)S3。影響ありとして記載：15.1(3)S5。影響ありとして記載：15.1(3)S6。影響ありとして記載：15.1(3)S5a。影響ありとして記載：15.1(4)M3。影響ありとして記載：15.1(4)M。影響ありとして記載：15.1(4)M1。影響ありとして記載：15.1(4)M2。影響ありとして記載：15.1(4)M6。影響ありとして記載：15.1(4)M5。影響ありとして記載：15.1(4)M4。影響ありとして記載：15.1(4)M7。影響ありとして記載：15.1(4)M3a。影響ありとして記載：15.1(4)M10。影響ありとして記載：15.1(4)M8。影響ありとして記載：15.1(4)M9。影響ありとして記載：15.0(2)SE。影響ありとして記載：15.0(2)SE1。影響ありとして記載：15.0(2)SE2。影響ありとして記載：15.0(2)SE3。影響ありとして記載：15.0(2)SE4。影響ありとして記載：15.0(2)SE5。影響ありとして記載：15.0(2)SE6。影響ありとして記載：15.0(2)SE7。影響ありとして記載：15.0(2)SE8。影響ありとして記載：15.0(2)SE9。影響ありとして記載：15.0(2)SE10。影響ありとして記載：15.0(2)SE11。影響ありとして記載：15.0(2)SE10a。影響ありとして記載：15.0(2)SE12。影響ありとして記載：15.0(2)SE13。影響ありとして記載：15.1(2)GC。影響ありとして記載：15.1(2)GC1。影響ありとして記載：15.1(2)GC2。影響ありとして記載：15.1(4)GC。影響ありとして記載：15.1(4)GC1。影響ありとして記載：15.1(4)GC2。影響ありとして記載：15.1(1)SG。影響ありとして記載：15.1(2)SG。影響ありとして記載：15.1(1)SG1。影響ありとして記載：15.1(1)SG2。影響ありとして記載：15.1(2)SG1。影響ありとして記載：15.1(2)SG2。影響ありとして記載：15.1(2)SG3。影響ありとして記載：15.1(2)SG4。影響ありとして記載：15.1(2)SG5。影響ありとして記載：15.1(2)SG6。影響ありとして記載：15.1(2)SG7。影響ありとして記載：15.1(2)SG8。影響ありとして記載：15.0(1)MR。影響ありとして記載：15.0(2)MR。影響ありとして記載：15.2(4)M。影響ありとして記載：15.2(4)M1。影響ありとして記載：15.2(4)M2。影響ありとして記載：15.2(4)M4。影響ありとして記載：15.2(4)M3。影響ありとして記載：15.2(4)M5。影響ありとして記載：15.2(4)M8。影響ありとして記載：15.2(4)M10。影響ありとして記載：15.2(4)M7。影響ありとして記載：15.2(4)M6。影響ありとして記載：15.2(4)M9。影響ありとして記載：15.2(4)M6a。影響ありとして記載：15.2(4)M11。影響ありとして記載：12.4(24)MDB。影響ありとして記載：12.4(24)MDB1。影響ありとして記載：12.4(24)MDB3。影響ありとして記載：12.4(24)MDB4。影響ありとして記載：12.4(24)MDB5。影響ありとして記載：12.4(24)MDB6。影響ありとして記載：12.4(24)MDB7。影響ありとして記載：12.4(24)MDB5a。影響ありとして記載：12.4(24)MDB8。影響ありとして記載：12.4(24)MDB9。影響ありとして記載：12.4(24)MDB10。影響ありとして記載：12.4(24)MDB11。影響ありとして記載：12.4(24)MDB12。影響ありとして記載：12.4(24)MDB13。影響ありとして記載：12.4(24)MDB14。影響ありとして記載：12.4(24)MDB15。影響ありとして記載：12.4(24)MDB16。影響ありとして記載：12.4(24)MDB17。影響ありとして記載：12.4(24)MDB18。影響ありとして記載：12.4(24)MDB19。影響ありとして記載：15.0(2)EX。影響ありとして記載：15.0(2)EX1。影響ありとして記載：15.0(2)EX2。影響ありとして記載：15.0(2)EX3。影響ありとして記載：15.0(2)EX4。影響ありとして記載：15.0(2)EX5。影響ありとして記載：15.0(2)EX8。影響ありとして記載：15.0(2a)EX5。影響ありとして記載：15.0(2)EX10。影響ありとして記載：15.0(2)EX11。影響ありとして記載：15.0(2)EX13。影響ありとして記載：15.0(2)EX12。影響ありとして記載：15.2(1)GC。影響ありとして記載：15.2(1)GC1。影響ありとして記載：15.2(1)GC2。影響ありとして記載：15.2(2)GC。影響ありとして記載：15.2(3)GC。影響ありとして記載：15.2(3)GC1。影響ありとして記載：15.2(4)GC。影響ありとして記載：15.2(4)GC1。影響ありとして記載：15.2(4)GC2。影響ありとして記載：15.2(4)GC3。影響ありとして記載：15.1(1)SY。影響ありとして記載：15.1(1)SY1。影響ありとして記載：15.1(2)SY。影響ありとして記載：15.1(2)SY1。影響ありとして記載：15.1(2)SY2。影響ありとして記載：15.1(1)SY2。影響ありとして記載：15.1(1)SY3。影響ありとして記載：15.1(2)SY3。影響ありとして記載：15.1(1)SY4。影響ありとして記載：15.1(2)SY4。影響ありとして記載：15.1(1)SY5。影響ありとして記載：15.1(2)SY5。影響ありとして記載：15.1(2)SY4a。影響ありとして記載：15.1(1)SY6。影響ありとして記載：15.1(2)SY6。影響ありとして記載：15.1(2)SY7。影響ありとして記載：15.1(2)SY8。影響ありとして記載：15.1(2)SY9。影響ありとして記載：15.1(2)SY10。影響ありとして記載：15.1(2)SY11。影響ありとして記載：15.1(2)SY12。影響ありとして記載：15.1(2)SY13。影響ありとして記載：15.1(2)SY14。影響ありとして記載：15.1(2)SY15。影響ありとして記載：15.1(2)SY16。影響ありとして記載：15.3(1)S。影響ありとして記載：15.3(2)S。影響ありとして記載：15.3(3)S。影響ありとして記載：15.3(1)S2。影響ありとして記載：15.3(1)S1。影響ありとして記載：15.3(2)S2。影響ありとして記載：15.3(2)S1。影響ありとして記載：15.3(3)S1。影響ありとして記載：15.3(3)S2。\n・公式の対象表：Cisco / Cisco IOS XE Software。影響ありとして記載：3.7.0S。影響ありとして記載：3.7.1S。影響ありとして記載：3.7.2S。影響ありとして記載：3.7.3S。影響ありとして記載：3.7.4S。影響ありとして記載：3.7.5S。影響ありとして記載：3.7.6S。影響ありとして記載：3.7.7S。影響ありとして記載：3.7.4aS。影響ありとして記載：3.7.2tS。影響ありとして記載：3.7.0bS。影響ありとして記載：3.7.1aS。影響ありとして記載：3.3.0SG。影響ありとして記載：3.3.2SG。影響ありとして記載：3.3.1SG。影響ありとして記載：3.8.0S。影響ありとして記載：3.8.1S。影響ありとして記載：3.8.2S。影響ありとして記載：3.9.1S。影響ありとして記載：3.9.0S。影響ありとして記載：3.9.2S。影響ありとして記載：3.9.1aS。影響ありとして記載：3.9.0aS。影響ありとして記載：3.4.0SG。影響ありとして記載：3.4.2SG。影響ありとして記載：3.4.1SG。影響ありとして記載：3.4.3SG。影響ありとして記載：3.4.4SG。影響ありとして記載：3.4.5SG。影響ありとして記載：3.4.6SG。影響ありとして記載：3.4.7SG。影響ありとして記載：3.4.8SG。影響ありとして記載：3.5.0E。影響ありとして記載：3.5.1E。影響ありとして記載：3.5.2E。影響ありとして記載：3.5.3E。影響ありとして記載：3.10.0S。影響ありとして記載：3.10.1S。影響ありとして記載：3.10.2S。影響ありとして記載：3.10.3S。影響ありとして記載：3.10.4S。影響ありとして記載：3.10.5S。影響ありとして記載：3.10.6S。影響ありとして記載：3.10.2tS。影響ありとして記載：3.10.7S。影響ありとして記載：3.10.1xbS。影響ありとして記載：3.10.8S。影響ありとして記載：3.10.8aS。影響ありとして記載：3.10.9S。影響ありとして記載：3.10.10S。影響ありとして記載：3.11.1S。影響ありとして記載：3.11.2S。影響ありとして記載：3.11.0S。影響ありとして記載：3.11.3S。影響ありとして記載：3.11.4S。影響ありとして記載：3.12.0S。影響ありとして記載：3.12.1S。影響ありとして記載：3.12.2S。影響ありとして記載：3.12.3S。影響ありとして記載：3.12.0aS。影響ありとして記載：3.12.4S。影響ありとして記載：3.13.0S。影響ありとして記載：3.13.1S。影響ありとして記載：3.13.2S。影響ありとして記載：3.13.3S。影響ありとして記載：3.13.4S。影響ありとして記載：3.13.5S。影響ありとして記載：3.13.2aS。影響ありとして記載：3.13.0aS。影響ありとして記載：3.13.5aS。影響ありとして記載：3.13.6S。影響ありとして記載：3.13.7S。影響ありとして記載：3.13.6aS。影響ありとして記載：3.13.7aS。影響ありとして記載：3.13.8S。影響ありとして記載：3.13.9S。影響ありとして記載：3.13.10S。影響ありとして記載：3.6.0E。影響ありとして記載：3.6.1E。影響ありとして記載：3.6.2aE。影響ありとして記載：3.6.2E。影響ありとして記載：3.6.3E。影響ありとして記載：3.6.4E。影響ありとして記載：3.6.5E。影響ありとして記載：3.6.6E。影響ありとして記載：3.6.5aE。影響ありとして記載：3.6.5bE。影響ありとして記載：3.6.7E。影響ありとして記載：3.6.8E。影響ありとして記載：3.6.7bE。影響ありとして記載：3.6.9E。影響ありとして記載：3.6.10E。影響ありとして記載：3.14.0S。影響ありとして記載：3.14.1S。影響ありとして記載：3.14.2S。影響ありとして記載：3.14.3S。影響ありとして記載：3.14.4S。影響ありとして記載：3.15.0S。影響ありとして記載：3.15.1S。影響ありとして記載：3.15.2S。影響ありとして記載：3.15.1cS。影響ありとして記載：3.15.3S。影響ありとして記載：3.15.4S。影響ありとして記載：3.16.0S。影響ありとして記載：3.16.1S。影響ありとして記載：3.16.1aS。影響ありとして記載：3.16.2S。影響ありとして記載：3.16.2aS。影響ありとして記載：3.16.0cS。影響ありとして記載：3.16.3S。影響ありとして記載：3.16.2bS。影響ありとして記載：3.16.3aS。影響ありとして記載：3.16.4S。影響ありとして記載：3.16.4aS。影響ありとして記載：3.16.4bS。影響ありとして記載：3.16.5S。影響ありとして記載：3.16.4dS。影響ありとして記載：3.16.6S。影響ありとして記載：3.16.7S。影響ありとして記載：3.16.6bS。影響ありとして記載：3.16.7aS。影響ありとして記載：3.16.7bS。影響ありとして記載：3.16.8S。影響ありとして記載：3.16.9S。影響ありとして記載：3.16.10S。影響ありとして記載：3.17.0S。影響ありとして記載：3.17.1S。影響ありとして記載：3.17.2S。影響ありとして記載：3.17.1aS。影響ありとして記載：3.17.3S。影響ありとして記載：3.17.4S。影響ありとして記載：16.1.1。影響ありとして記載：16.1.2。影響ありとして記載：16.1.3。影響ありとして記載：16.2.1。影響ありとして記載：16.2.2。影響ありとして記載：3.8.0E。影響ありとして記載：3.8.1E。影響ありとして記載：3.8.2E。影響ありとして記載：3.8.3E。影響ありとして記載：3.8.4E。影響ありとして記載：3.8.5E。影響ありとして記載：3.8.5aE。影響ありとして記載：3.8.6E。影響ありとして記載：3.8.7E。影響ありとして記載：3.8.8E。影響ありとして記載：3.8.9E。影響ありとして記載：3.8.10E。影響ありとして記載：16.3.1。影響ありとして記載：16.3.2。影響ありとして記載：16.3.3。影響ありとして記載：16.3.1a。影響ありとして記載：16.3.4。影響ありとして記載：16.3.5。影響ありとして記載：16.3.5b。影響ありとして記載：16.3.6。影響ありとして記載：16.3.7。影響ありとして記載：16.3.8。影響ありとして記載：16.3.9。影響ありとして記載：16.3.10。影響ありとして記載：16.3.11。影響ありとして記載：16.4.1。影響ありとして記載：16.4.2。影響ありとして記載：16.4.3。影響ありとして記載：16.5.1。影響ありとして記載：16.5.1a。影響ありとして記載：16.5.1b。影響ありとして記載：16.5.2。影響ありとして記載：16.5.3。影響ありとして記載：3.18.0aS。影響ありとして記載：3.18.0S。影響ありとして記載：3.18.1S。影響ありとして記載：3.18.2S。影響ありとして記載：3.18.3S。影響ありとして記載：3.18.4S。影響ありとして記載：3.18.0SP。影響ありとして記載：3.18.1SP。影響ありとして記載：3.18.1aSP。影響ありとして記載：3.18.1bSP。影響ありとして記載：3.18.1cSP。影響ありとして記載：3.18.2SP。影響ありとして記載：3.18.2aSP。影響ありとして記載：3.18.3SP。影響ありとして記載：3.18.4SP。影響ありとして記載：3.18.3aSP。影響ありとして記載：3.18.3bSP。影響ありとして記載：3.18.5SP。影響ありとして記載：3.18.6SP。影響ありとして記載：3.18.7SP。影響ありとして記載：3.18.8aSP。影響ありとして記載：3.18.9SP。影響ありとして記載：3.9.0E。影響ありとして記載：3.9.1E。影響ありとして記載：3.9.2E。影響ありとして記載：16.6.1。影響ありとして記載：16.6.2。影響ありとして記載：16.6.3。影響ありとして記載：16.6.4。影響ありとして記載：16.6.5。影響ありとして記載：16.6.4a。影響ありとして記載：16.6.5a。影響ありとして記載：16.6.6。影響ありとして記載：16.6.7。影響ありとして記載：16.6.8。影響ありとして記載：16.6.9。影響ありとして記載：16.6.10。影響ありとして記載：16.7.1。影響ありとして記載：16.7.1a。影響ありとして記載：16.7.1b。影響ありとして記載：16.7.2。影響ありとして記載：16.7.3。影響ありとして記載：16.7.4。影響ありとして記載：16.8.1。影響ありとして記載：16.8.1a。影響ありとして記載：16.8.1b。影響ありとして記載：16.8.1s。影響ありとして記載：16.8.1c。影響ありとして記載：16.8.1d。影響ありとして記載：16.8.2。影響ありとして記載：16.8.1e。影響ありとして記載：16.8.3。影響ありとして記載：16.9.1。影響ありとして記載：16.9.2。影響ありとして記載：16.9.1a。影響ありとして記載：16.9.1b。影響ありとして記載：16.9.1s。影響ありとして記載：16.9.3。影響ありとして記載：16.9.4。影響ありとして記載：16.9.3a。影響ありとして記載：16.9.5。影響ありとして記載：16.9.5f。影響ありとして記載：16.9.6。影響ありとして記載：16.9.7。影響ありとして記載：16.9.8。影響ありとして記載：16.10.1。影響ありとして記載：16.10.1a。影響ありとして記載：16.10.1b。影響ありとして記載：16.10.1s。影響ありとして記載：16.10.1c。影響ありとして記載：16.10.1e。影響ありとして記載：16.10.1d。影響ありとして記載：16.10.2。影響ありとして記載：16.10.1f。影響ありとして記載：16.10.1g。影響ありとして記載：16.10.3。影響ありとして記載：3.10.0E。影響ありとして記載：3.10.1E。影響ありとして記載：3.10.0cE。影響ありとして記載：3.10.2E。影響ありとして記載：3.10.3E。影響ありとして記載：16.11.1。影響ありとして記載：16.11.1a。影響ありとして記載：16.11.1b。影響ありとして記載：16.11.2。影響ありとして記載：16.11.1s。影響ありとして記載：16.12.1。影響ありとして記載：16.12.1s。影響ありとして記載：16.12.1a。影響ありとして記載：16.12.1c。影響ありとして記載：16.12.1w。影響ありとして記載：16.12.2。影響ありとして記載：16.12.1y。影響ありとして記載：16.12.2a。影響ありとして記載：16.12.3。影響ありとして記載：16.12.8。影響ありとして記載：16.12.2s。影響ありとして記載：16.12.1x。影響ありとして記載：16.12.1t。影響ありとして記載：16.12.4。影響ありとして記載：16.12.3s。影響ありとして記載：16.12.3a。影響ありとして記載：16.12.4a。影響ありとして記載：16.12.5。影響ありとして記載：16.12.6。影響ありとして記載：16.12.1z1。影響ありとして記載：16.12.5a。影響ありとして記載：16.12.5b。影響ありとして記載：16.12.1z2。影響ありとして記載：16.12.6a。影響ありとして記載：16.12.7。影響ありとして記載：16.12.9。影響ありとして記載：3.11.0E。影響ありとして記載：3.11.1E。影響ありとして記載：3.11.2E。影響ありとして記載：3.11.3E。影響ありとして記載：3.11.1aE。影響ありとして記載：3.11.4E。影響ありとして記載：3.11.3aE。影響ありとして記載：3.11.5E。影響ありとして記載：3.11.6E。影響ありとして記載：3.11.7E。影響ありとして記載：3.11.8E。影響ありとして記載：17.1.1。影響ありとして記載：17.1.1a。影響ありとして記載：17.1.1s。影響ありとして記載：17.1.1t。影響ありとして記載：17.1.3。影響ありとして記載：17.2.1。影響ありとして記載：17.2.1r。影響ありとして記載：17.2.1a。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-20109", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T05:26:38.319Z", "lastSuccess": "2026-10-24T05:26:38.319Z", "sourceCheckedAt": "2026-10-24T05:26:38.319Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" }, { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } } ], "total": 2287, "limit": 20, "offset": 1240, "filters": { "product": "all", "type": "all", "q": "", "page": 63 }, "pagination": { "page": 63, "pageSize": 20, "totalPages": 115 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-25T05:17:50.551Z", "lastAttempt": "2026-10-25T05:17:50.551Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-25T05:17:50.551Z", "lastAttempt": "2026-10-25T05:17:50.551Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-25T05:17:50.551Z", "lastAttempt": "2026-10-25T05:17:50.551Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-25T05:17:50.551Z", "lastAttempt": "2026-10-25T05:17:50.551Z", "error": null, "recordCount": 6, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-24T22:02:49.743Z 〜 2026-10-25T05:17:50.551Z、全製品の変更 415/415件まで確認、対象6件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-25T05:17:50.551Z", "lastAttempt": "2026-10-25T05:17:50.551Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }