{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2023-27992", "aliases": [], "title": "NAS326 firmware / NAS540 firmware / NAS542 firmware：脆弱性情報", "summary": "Zyxel の NAS326、NAS540、NAS542 のファームウェア（それぞれ V5.21(AAZF.14)C0 未満、V5.21(AATB.11)C0 未満、V5.21(ABAG.11)C0 未満）に、認証前のコマンドインジェクション脆弱性があり、認証されていない攻撃者が細工した HTTP リクエストを送ることでリモートで OS コマンドを実行できる可能性があります。", "risk": "攻撃者がリモートで OS コマンドを実行できるため、システムが不正に操作される恐れがあります。", "product": "NAS326 firmware / NAS540 firmware / NAS542 firmware", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Zyxel", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "NAS326 firmware", "range": "< V5.21(AAZF.14)C0" }, { "product": "NAS540 firmware", "range": "< V5.21(AATB.11)C0" }, { "product": "NAS542 firmware", "range": "< V5.21(ABAG.11)C0" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用する。", "「CVE-2023-27992」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-27992", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27992", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-06-19T11:42:41.774Z", "modifiedAt": "2025-10-21T23:05:45.675Z", "fetchedAt": "2026-10-25T05:37:13.899Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "NAS326 firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "< V5.21(AAZF.14)C0" } ] }, { "defaultStatus": "unaffected", "product": "NAS540 firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "< V5.21(AATB.11)C0" } ] }, { "defaultStatus": "unaffected", "product": "NAS542 firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "< V5.21(ABAG.11)C0" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-27992", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "fetchedAt": "2026-10-25T05:37:13.899Z", "publishedAt": "2023-06-19T11:42:41.774Z", "modifiedAt": "2025-10-21T23:05:45.675Z", "state": "published", "provider": "Zyxel", "title": "", "descriptions": [ { "lang": "en", "value": "The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Zyxel", "product": "NAS326 firmware", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "< V5.21(AAZF.14)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "NAS540 firmware", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "< V5.21(AATB.11)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "NAS542 firmware", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "< V5.21(ABAG.11)C0", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Zyxel", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27992", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"NAS326 firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"< V5.21(AAZF.14)C0\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"NAS540 firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"< V5.21(AATB.11)C0\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"NAS542 firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"< V5.21(ABAG.11)C0\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-78\",\"description\":\"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-27992:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "sourcePath": "retained:/originalText", "text": "Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-27992:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "modifiedAt": "2023-06-23T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:45.675Z", "fetchedAt": "2026-10-25T05:37:13.899Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-23T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "NAS326 firmware / NAS540 firmware / NAS542 firmwareに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:37:13.899Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "de9211e5f104b3fcfbea9dbadeb94e3a52d4e2537915f7e8469a9ab727db44c9", "sourceModifiedAt": "2025-10-21T23:05:45.675Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zyxel の NAS326、NAS540、NAS542 のファームウェア（それぞれ V5.21(AAZF.14)C0 未満、V5.21(AATB.11)C0 未満、V5.21(ABAG.11)C0 未満）に、認証前のコマンドインジェクション脆弱性があり、認証されていない攻撃者が細工した HTTP リクエストを送ることでリモートで OS コマンドを実行できる可能性があります。", "risk": "攻撃者がリモートで OS コマンドを実行できるため、システムが不正に操作される恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者は認証されていない状態で攻撃を行える（認証前の脆弱性）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者は細工した HTTP リクエストを送信する必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃は認証が不要な状態で実行できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Zyxel / NAS326 firmware。影響ありとして記載：< V5.21(AAZF.14)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Zyxel / NAS540 firmware。影響ありとして記載：< V5.21(AATB.11)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Zyxel / NAS542 firmware。影響ありとして記載：< V5.21(ABAG.11)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json" ], "evidenceIds": [ "E2" ] }, { "text": "「NAS326 firmware / NAS540 firmware / NAS542 firmware」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-27992", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "https://nvd.nist.gov/vuln/detail/CVE-2023-27992" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992" ], "evidenceIds": [ "E5" ] }, { "text": "「CVE-2023-27992」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-27992", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "https://nvd.nist.gov/vuln/detail/CVE-2023-27992" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-27992", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "https://nvd.nist.gov/vuln/detail/CVE-2023-27992" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-27992", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "https://nvd.nist.gov/vuln/detail/CVE-2023-27992" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-27992", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "https://nvd.nist.gov/vuln/detail/CVE-2023-27992" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-27992", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27992", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"NAS326 firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"< V5.21(AAZF.14)C0\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"NAS540 firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"< V5.21(AATB.11)C0\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27992.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"NAS542 firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"< V5.21(ABAG.11)C0\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27992", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-27992\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-27992（NAS326 firmware / NAS540 firmware / NAS542 firmware）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者は認証されていない状態で攻撃を行える（認証前の脆弱性）。\n・攻撃者は細工した HTTP リクエストを送信する必要がある。\n・攻撃は認証が不要な状態で実行できる。\n・公式の対象表：Zyxel / NAS326 firmware。影響ありとして記載：< V5.21(AAZF.14)C0。\n・公式の対象表：Zyxel / NAS540 firmware。影響ありとして記載：< V5.21(AATB.11)C0。\n・公式の対象表：Zyxel / NAS542 firmware。影響ありとして記載：< V5.21(ABAG.11)C0。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-27992", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:37:13.899Z", "lastSuccess": "2026-10-25T05:37:13.899Z", "sourceCheckedAt": "2026-10-25T05:37:13.899Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-32434", "aliases": [], "title": "macOS / iOS and iPadOS / watchOS：コード実行", "summary": "整数オーバーフローが改善された入力検証により修正されました。この問題は watchOS 9.5.2、macOS Big Sur 11.7.8、iOS 15.7.7、iPadOS 15.7.7、macOS Monterey 12.6.7、watchOS 8.8.1、iOS 16.5.1、iPadOS 16.5.1、macOS Ventura 13.4.1 で修正されています。アプリがカーネル権限で任意のコードを実行できる可能性があり、iOS 15.7 より前のバージョンでこの問題が実際に悪用されたとの報告があります。", "risk": "アプリがカーネル権限で任意のコードを実行できる可能性があります。", "product": "macOS / iOS and iPadOS / watchOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "macOS", "range": ">= unspecified / < 12.6" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 15.7" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 16.5" }, { "product": "watchOS", "range": ">= unspecified / < 8.8" }, { "product": "watchOS", "range": ">= unspecified / < 9.5" }, { "product": "macOS", "range": ">= unspecified / < 13.4" }, { "product": "macOS", "range": ">= unspecified / < 11.7" } ], "fixed": [], "steps": [ "この問題は watchOS 9.5.2、macOS Big Sur 11.7.8、iOS 15.7.7、iPadOS 15.7.7、macOS Monterey 12.6.7、watchOS 8.8.1、iOS 16.5.1、iPadOS 16.5.1、macOS Ventura 13.4.1 で修正されています。", "ベンダーの指示に従ってアップデートを適用してください。", "「CVE-2023-32434」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-32434", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/HT213810", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213811", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213814", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213808", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213812", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213813", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213809", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/kb/HT213990", "label": "CVE掲載の参考情報" }, { "url": "http://seclists.org/fulldisclosure/2023/Oct/20", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-06-23T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:44.647Z", "fetchedAt": "2026-10-25T05:37:21.721Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "12.6", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "15.7", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "16.5", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "watchOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "8.8", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "watchOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "9.5", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "13.4", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "11.7", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-32434", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "fetchedAt": "2026-10-25T05:37:21.721Z", "publishedAt": "2023-06-23T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:44.647Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "unspecified", "lessThan": "12.6", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "unspecified", "lessThan": "15.7", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "unspecified", "lessThan": "16.5", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "watchOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "unspecified", "lessThan": "8.8", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "watchOS", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "unspecified", "lessThan": "9.5", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/5", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "unspecified", "lessThan": "13.4", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/6", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "unspecified", "lessThan": "11.7", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/HT213810", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://support.apple.com/en-us/HT213811", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://support.apple.com/en-us/HT213814", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://support.apple.com/en-us/HT213808", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://support.apple.com/en-us/HT213812", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://support.apple.com/en-us/HT213813", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://support.apple.com/en-us/HT213809", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://support.apple.com/kb/HT213990", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "http://seclists.org/fulldisclosure/2023/Oct/20", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32434", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"12.6\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.7\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"8.8\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"9.5\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"13.4\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"11.7\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.8,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-32434:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434", "sourcePath": "retained:/originalText", "text": "Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-32434:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434", "modifiedAt": "2023-06-23T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:44.647Z", "fetchedAt": "2026-10-25T05:37:21.721Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-23T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "macOS / iOS and iPadOS / watchOSにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:37:21.721Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "49cff2dec726a7f77c25a1caa8c6a588207fec3525c79391ed59569c9ba07221", "sourceModifiedAt": "2025-10-21T23:05:44.647Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "整数オーバーフローが改善された入力検証により修正されました。この問題は watchOS 9.5.2、macOS Big Sur 11.7.8、iOS 15.7.7、iPadOS 15.7.7、macOS Monterey 12.6.7、watchOS 8.8.1、iOS 16.5.1、iPadOS 16.5.1、macOS Ventura 13.4.1 で修正されています。アプリがカーネル権限で任意のコードを実行できる可能性があり、iOS 15.7 より前のバージョンでこの問題が実際に悪用されたとの報告があります。", "risk": "アプリがカーネル権限で任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "公式の対象表：Apple / macOS。影響ありとして記載：12.6未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.7未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：16.5未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / watchOS。影響ありとして記載：8.8未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Apple / watchOS。影響ありとして記載：9.5未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：13.4未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：11.7未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json" ], "evidenceIds": [ "E8" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434" ], "evidenceIds": [ "E10" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json" ], "evidenceIds": [ "E2" ] }, { "text": "「macOS / iOS and iPadOS / watchOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-32434", "https://support.apple.com/en-us/HT213810", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213814", "https://support.apple.com/en-us/HT213808", "https://support.apple.com/en-us/HT213812", "https://support.apple.com/en-us/HT213813", "https://support.apple.com/en-us/HT213809", "https://support.apple.com/kb/HT213990", "http://seclists.org/fulldisclosure/2023/Oct/20", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434" ] } ], "actions": [ { "text": "この問題は watchOS 9.5.2、macOS Big Sur 11.7.8、iOS 15.7.7、iPadOS 15.7.7、macOS Monterey 12.6.7、watchOS 8.8.1、iOS 16.5.1、iPadOS 16.5.1、macOS Ventura 13.4.1 で修正されています。", "kind": "fix", "evidenceIds": [ "E1" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json" ] }, { "text": "ベンダーの指示に従ってアップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434" ], "evidenceIds": [ "E9" ] }, { "text": "「CVE-2023-32434」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-32434", "https://support.apple.com/en-us/HT213810", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213814", "https://support.apple.com/en-us/HT213808", "https://support.apple.com/en-us/HT213812", "https://support.apple.com/en-us/HT213813", "https://support.apple.com/en-us/HT213809", "https://support.apple.com/kb/HT213990", "http://seclists.org/fulldisclosure/2023/Oct/20", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-32434", "https://support.apple.com/en-us/HT213810", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213814", "https://support.apple.com/en-us/HT213808", "https://support.apple.com/en-us/HT213812", "https://support.apple.com/en-us/HT213813", "https://support.apple.com/en-us/HT213809", "https://support.apple.com/kb/HT213990", "http://seclists.org/fulldisclosure/2023/Oct/20", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-32434", "https://support.apple.com/en-us/HT213810", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213814", "https://support.apple.com/en-us/HT213808", "https://support.apple.com/en-us/HT213812", "https://support.apple.com/en-us/HT213813", "https://support.apple.com/en-us/HT213809", "https://support.apple.com/kb/HT213990", "http://seclists.org/fulldisclosure/2023/Oct/20", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-32434", "https://support.apple.com/en-us/HT213810", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213814", "https://support.apple.com/en-us/HT213808", "https://support.apple.com/en-us/HT213812", "https://support.apple.com/en-us/HT213813", "https://support.apple.com/en-us/HT213809", "https://support.apple.com/kb/HT213990", "http://seclists.org/fulldisclosure/2023/Oct/20", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-32434", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/HT213810", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213811", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213814", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213808", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213812", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213813", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213809", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/kb/HT213990", "label": "CVE掲載の参考情報" }, { "url": "http://seclists.org/fulldisclosure/2023/Oct/20", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"12.6\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.7\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"8.8\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"9.5\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"13.4\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32434.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"11.7\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E10", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32434", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-32434\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-32434（macOS / iOS and iPadOS / watchOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Apple / macOS。影響ありとして記載：12.6未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.7未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：16.5未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / watchOS。影響ありとして記載：8.8未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / watchOS。影響ありとして記載：9.5未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / macOS。影響ありとして記載：13.4未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / macOS。影響ありとして記載：11.7未満（原資料では開始版が未指定）。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-32434", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:37:21.721Z", "lastSuccess": "2026-10-25T05:37:21.721Z", "sourceCheckedAt": "2026-10-25T05:37:21.721Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-32435", "aliases": [], "title": "macOS / iOS and iPadOS / Safari：コード実行", "summary": "メモリ破損の問題が状態管理の改善により対策されました。この問題は macOS Ventura 13.3、Safari 16.4、iOS 16.4、iPadOS 16.4、iOS 15.7.7、iPadOS 15.7.7 で修正されています。Web コンテンツを処理する際に任意のコード実行につながる可能性があり、Apple は iOS 15.7 以前のバージョンでこの問題が実際に悪用されたとの報告を認識しています。", "risk": "Web コンテンツの処理中に任意のコードが実行される可能性があります。", "product": "macOS / iOS and iPadOS / Safari", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "macOS", "range": ">= unspecified / < 13.3" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 15.7" }, { "product": "Safari", "range": ">= unspecified / < 16.4" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 16.4" } ], "fixed": [], "steps": [ "この問題は macOS Ventura 13.3、Safari 16.4、iOS 16.4、iPadOS 16.4、iOS 15.7.7、iPadOS 15.7.7 で修正されています。", "ベンダーの指示に従ってアップデートを適用してください。", "「CVE-2023-32435」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-32435", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/HT213670", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213811", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213671", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213676", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32435", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-06-23T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:44.502Z", "fetchedAt": "2026-10-25T05:37:29.761Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "13.3", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "15.7", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "Safari", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "16.4", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "16.4", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-32435", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "fetchedAt": "2026-10-25T05:37:29.761Z", "publishedAt": "2023-06-23T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:44.502Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "unspecified", "lessThan": "13.3", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "unspecified", "lessThan": "15.7", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "Safari", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "unspecified", "lessThan": "16.4", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "unspecified", "lessThan": "16.4", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/HT213670", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://support.apple.com/en-us/HT213811", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://support.apple.com/en-us/HT213671", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://support.apple.com/en-us/HT213676", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32435", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"13.3\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.7\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.4\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.4\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-32435:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "sourcePath": "retained:/originalText", "text": "Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-32435:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "modifiedAt": "2023-06-23T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:44.502Z", "fetchedAt": "2026-10-25T05:37:29.761Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-23T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "macOS / iOS and iPadOS / Safariにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:37:29.761Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a92d38286e16b82e4c64614b2022604ccddd216504e71501d334a97303fd1ea3", "sourceModifiedAt": "2025-10-21T23:05:44.502Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "メモリ破損の問題が状態管理の改善により対策されました。この問題は macOS Ventura 13.3、Safari 16.4、iOS 16.4、iPadOS 16.4、iOS 15.7.7、iPadOS 15.7.7 で修正されています。Web コンテンツを処理する際に任意のコード実行につながる可能性があり、Apple は iOS 15.7 以前のバージョンでこの問題が実際に悪用されたとの報告を認識しています。", "risk": "Web コンテンツの処理中に任意のコードが実行される可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "公式の対象表：Apple / macOS。影響ありとして記載：13.3未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.7未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / Safari。影響ありとして記載：16.4未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：16.4未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435" ], "evidenceIds": [ "E7" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json" ], "evidenceIds": [ "E2" ] }, { "text": "「macOS / iOS and iPadOS / Safari」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-32435", "https://support.apple.com/en-us/HT213670", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213671", "https://support.apple.com/en-us/HT213676", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "https://nvd.nist.gov/vuln/detail/CVE-2023-32435" ] } ], "actions": [ { "text": "この問題は macOS Ventura 13.3、Safari 16.4、iOS 16.4、iPadOS 16.4、iOS 15.7.7、iPadOS 15.7.7 で修正されています。", "kind": "fix", "evidenceIds": [ "E1" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json" ] }, { "text": "ベンダーの指示に従ってアップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435" ], "evidenceIds": [ "E6" ] }, { "text": "「CVE-2023-32435」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-32435", "https://support.apple.com/en-us/HT213670", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213671", "https://support.apple.com/en-us/HT213676", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "https://nvd.nist.gov/vuln/detail/CVE-2023-32435" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-32435", "https://support.apple.com/en-us/HT213670", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213671", "https://support.apple.com/en-us/HT213676", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "https://nvd.nist.gov/vuln/detail/CVE-2023-32435" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-32435", "https://support.apple.com/en-us/HT213670", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213671", "https://support.apple.com/en-us/HT213676", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "https://nvd.nist.gov/vuln/detail/CVE-2023-32435" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-32435", "https://support.apple.com/en-us/HT213670", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213671", "https://support.apple.com/en-us/HT213676", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "https://nvd.nist.gov/vuln/detail/CVE-2023-32435" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-32435", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/HT213670", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213811", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213671", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213676", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32435", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"13.3\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.7\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.4\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32435.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.4\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32435", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-32435\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-32435（macOS / iOS and iPadOS / Safari）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Apple / macOS。影響ありとして記載：13.3未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.7未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / Safari。影響ありとして記載：16.4未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：16.4未満（原資料では開始版が未指定）。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-32435", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:37:29.761Z", "lastSuccess": "2026-10-25T05:37:29.761Z", "sourceCheckedAt": "2026-10-25T05:37:29.761Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-32439", "aliases": [], "title": "iOS and iPadOS / Safari / macOS：コード実行", "summary": "悪意のある細工が施されたウェブコンテンツを処理すると、任意のコードを実行させられる可能性があります。Apple はこの問題が実際に悪用されているとの報告を認識しています。", "risk": "攻撃者が任意のコードを実行できる可能性があります。", "product": "iOS and iPadOS / Safari / macOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "iOS and iPadOS", "range": ">= unspecified / < 15.7" }, { "product": "Safari", "range": ">= unspecified / < 16.5" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 16.5" }, { "product": "macOS", "range": ">= unspecified / < 13.4" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用する。", "「CVE-2023-32439」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-32439", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/HT213811", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213816", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213814", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213813", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/kb/HT213814", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/kb/HT213816", "label": "CVE掲載の参考情報" }, { "url": "https://security.gentoo.org/glsa/202401-04", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32439", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-06-23T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:44.317Z", "fetchedAt": "2026-10-25T05:37:41.389Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "15.7", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "Safari", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "16.5", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "16.5", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "13.4", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-32439", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "fetchedAt": "2026-10-25T05:37:41.389Z", "publishedAt": "2023-06-23T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:44.317Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "unspecified", "lessThan": "15.7", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "Safari", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "unspecified", "lessThan": "16.5", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "unspecified", "lessThan": "16.5", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "unspecified", "lessThan": "13.4", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/HT213811", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://support.apple.com/en-us/HT213816", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://support.apple.com/en-us/HT213814", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://support.apple.com/en-us/HT213813", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://support.apple.com/kb/HT213814", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://support.apple.com/kb/HT213816", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://security.gentoo.org/glsa/202401-04", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32439", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.7\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"13.4\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-32439:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "sourcePath": "retained:/originalText", "text": "Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-32439:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "modifiedAt": "2023-06-23T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:44.317Z", "fetchedAt": "2026-10-25T05:37:41.389Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-23T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "iOS and iPadOS / Safari / macOSにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:37:41.389Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "79402a82ece323abe021f4f644a5828ea9e46660727c5397247acb52a40273da", "sourceModifiedAt": "2025-10-21T23:05:44.317Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "悪意のある細工が施されたウェブコンテンツを処理すると、任意のコードを実行させられる可能性があります。Apple はこの問題が実際に悪用されているとの報告を認識しています。", "risk": "攻撃者が任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.7未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Apple / Safari。影響ありとして記載：16.5未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：16.5未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：13.4未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439" ], "evidenceIds": [ "E7" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json" ], "evidenceIds": [ "E2" ] }, { "text": "「iOS and iPadOS / Safari / macOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-32439", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213816", "https://support.apple.com/en-us/HT213814", "https://support.apple.com/en-us/HT213813", "https://support.apple.com/kb/HT213814", "https://support.apple.com/kb/HT213816", "https://security.gentoo.org/glsa/202401-04", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "https://nvd.nist.gov/vuln/detail/CVE-2023-32439" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439" ], "evidenceIds": [ "E6" ] }, { "text": "「CVE-2023-32439」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-32439", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213816", "https://support.apple.com/en-us/HT213814", "https://support.apple.com/en-us/HT213813", "https://support.apple.com/kb/HT213814", "https://support.apple.com/kb/HT213816", "https://security.gentoo.org/glsa/202401-04", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "https://nvd.nist.gov/vuln/detail/CVE-2023-32439" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-32439", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213816", "https://support.apple.com/en-us/HT213814", "https://support.apple.com/en-us/HT213813", "https://support.apple.com/kb/HT213814", "https://support.apple.com/kb/HT213816", "https://security.gentoo.org/glsa/202401-04", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "https://nvd.nist.gov/vuln/detail/CVE-2023-32439" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-32439", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213816", "https://support.apple.com/en-us/HT213814", "https://support.apple.com/en-us/HT213813", "https://support.apple.com/kb/HT213814", "https://support.apple.com/kb/HT213816", "https://security.gentoo.org/glsa/202401-04", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "https://nvd.nist.gov/vuln/detail/CVE-2023-32439" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-32439", "https://support.apple.com/en-us/HT213811", "https://support.apple.com/en-us/HT213816", "https://support.apple.com/en-us/HT213814", "https://support.apple.com/en-us/HT213813", "https://support.apple.com/kb/HT213814", "https://support.apple.com/kb/HT213816", "https://security.gentoo.org/glsa/202401-04", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "https://nvd.nist.gov/vuln/detail/CVE-2023-32439" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-32439", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/HT213811", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213816", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213814", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/HT213813", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/kb/HT213814", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/kb/HT213816", "label": "CVE掲載の参考情報" }, { "url": "https://security.gentoo.org/glsa/202401-04", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32439", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.7\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32439.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"13.4\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-32439", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-32439\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-32439（iOS and iPadOS / Safari / macOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.7未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / Safari。影響ありとして記載：16.5未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：16.5未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / macOS。影響ありとして記載：13.4未満（原資料では開始版が未指定）。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-32439", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:37:41.389Z", "lastSuccess": "2026-10-25T05:37:41.389Z", "sourceCheckedAt": "2026-10-25T05:37:41.389Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2016-0165", "aliases": [], "title": "n/a：権限の奪取", "summary": "Microsoft Windows Vista SP2、Windows Server 2008 SP2 と R2 SP1、Windows 7 SP1、Windows 8.1、Windows Server 2012 Gold と R2、Windows RT 8.1、Windows 10 Gold と 1511 のカーネルモードドライバーが、細工したアプリケーションを使用するローカルユーザーに特権を取得させることができる、いわゆる「Win32k 権限昇格脆弱性」です。", "risk": "攻撃者はローカルユーザーの権限を昇格させ、システム上でより高い権限でコードを実行できるようになる可能性があります。", "product": "Microsoft Win32k", "category": "windows", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "microsoft", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従って更新プログラムを適用する。", "「CVE-2016-0165」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2016-0165", "label": "CVE公式レコード" }, { "url": "http://www.securitytracker.com/id/1035529", "label": "1035529" }, { "url": "https://www.exploit-db.com/exploits/44480/", "label": "44480" }, { "url": "http://www.securitytracker.com/id/1035532", "label": "1035532" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039", "label": "MS16-039" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0165", "label": "CISAが示す関連情報" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2016-04-12T23:00:00.000Z", "modifiedAt": "2025-10-21T23:55:53.587Z", "fetchedAt": "2026-10-25T05:37:45.711Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-0143 and CVE-2016-0167.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2016-0165", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json", "fetchedAt": "2026-10-25T05:37:45.711Z", "publishedAt": "2016-04-12T23:00:00.000Z", "modifiedAt": "2025-10-21T23:55:53.587Z", "state": "published", "provider": "microsoft", "title": "", "descriptions": [ { "lang": "en", "value": "The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-0143 and CVE-2016-0167.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://www.securitytracker.com/id/1035529", "label": "1035529", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.exploit-db.com/exploits/44480/", "label": "44480", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://www.securitytracker.com/id/1035532", "label": "1035532", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039", "label": "MS16-039", "tags": [ "vendor-advisory", "x_refsource_MS", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0165", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-0143 and CVE-2016-0167.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.8,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2016-0165:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "sourcePath": "retained:/originalText", "text": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2016-0165:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:55:53.587Z", "fetchedAt": "2026-10-25T05:37:45.711Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "n/aに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:37:45.711Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7603fdb5e734c2aab2a1bdc66668b890a61fc276a491721c427cad55c912c42a", "sourceModifiedAt": "2025-10-21T23:55:53.587Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Windows Vista SP2、Windows Server 2008 SP2 と R2 SP1、Windows 7 SP1、Windows 8.1、Windows Server 2012 Gold と R2、Windows RT 8.1、Windows 10 Gold と 1511 のカーネルモードドライバーが、細工したアプリケーションを使用するローカルユーザーに特権を取得させることができる、いわゆる「Win32k 権限昇格脆弱性」です。", "risk": "攻撃者はローカルユーザーの権限を昇格させ、システム上でより高い権限でコードを実行できるようになる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象 OS: Windows Vista SP2", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象 OS: Windows Server 2008 SP2", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象 OS: Windows Server 2008 R2 SP1", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象 OS: Windows 7 SP1", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象 OS: Windows 8.1", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象 OS: Windows Server 2012 Gold", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象 OS: Windows Server 2012 R2", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象 OS: Windows RT 8.1", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象 OS: Windows 10 Gold", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象 OS: Windows 10 1511", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者はローカルユーザーであり、細工したアプリケーションを実行できる必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "ベンダーの指示に従って更新プログラムを適用する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2016-0165」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2016-0165", "http://www.securitytracker.com/id/1035529", "https://www.exploit-db.com/exploits/44480/", "http://www.securitytracker.com/id/1035532", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039", "https://nvd.nist.gov/vuln/detail/CVE-2016-0165" ] }, { "text": "Windows 11は「設定」→「Windows Update」→「更新プログラムのチェック」を開き、提供された更新を適用します。再起動を求められたら完了させます。会社管理のPC、Windows Server、サポート外の版は管理担当者に適用する修正番号と配布予定を確認してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2016-0165", "http://www.securitytracker.com/id/1035529", "https://www.exploit-db.com/exploits/44480/", "http://www.securitytracker.com/id/1035532", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039", "https://nvd.nist.gov/vuln/detail/CVE-2016-0165" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2016-0165", "label": "CVE公式レコード" }, { "url": "http://www.securitytracker.com/id/1035529", "label": "1035529" }, { "url": "https://www.exploit-db.com/exploits/44480/", "label": "44480" }, { "url": "http://www.securitytracker.com/id/1035532", "label": "1035532" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039", "label": "MS16-039" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0165", "label": "CISAが示す関連情報" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-0143 and CVE-2016-0167.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "sourceField": "retained:/originalText", "excerpt": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/0xxx/CVE-2016-0165.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "sourceField": "/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0165", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2016-0165\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2016-0165（Microsoft Win32k）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象 OS: Windows Vista SP2\n・対象 OS: Windows Server 2008 SP2\n・対象 OS: Windows Server 2008 R2 SP1\n・対象 OS: Windows 7 SP1\n・対象 OS: Windows 8.1\n・対象 OS: Windows Server 2012 Gold\n・対象 OS: Windows Server 2012 R2\n・対象 OS: Windows RT 8.1\n・対象 OS: Windows 10 Gold\n・対象 OS: Windows 10 1511\n・攻撃者はローカルユーザーであり、細工したアプリケーションを実行できる必要がある。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2016-0165", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:37:45.711Z", "lastSuccess": "2026-10-25T05:37:45.711Z", "sourceCheckedAt": "2026-10-25T05:37:45.711Z", "errorCode": null }, "glossary": [ { "term": "権限昇格", "meaning": "本来その利用者には許可されていない、より強い権限で操作できるようになることです。必要な元の権限と、得られる権限を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/269.html", "kind": "general_definition" } ] } }, { "id": "CVE-2016-9079", "aliases": [], "title": "Firefox / Firefox ESR / Thunderbird：脆弱性情報", "summary": "SVG アニメーションの use‑after‑free 脆弱性が発見され、Windows 上の Firefox、Firefox ESR、Thunderbird のいずれかを使用しているユーザー、ならびに Tor Browser（Windows）ユーザーを対象とした実際の攻撃が確認されています。また、影響を受けるバージョンは Firefox < 50.0.2、Firefox ESR < 45.5.1、Thunderbird < 45.5.1 です。", "risk": "この脆弱性は実際に悪用が確認されており、対象製品を使用している Windows ユーザーが攻撃を受ける可能性があります。", "product": "Firefox / Firefox ESR / Thunderbird", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mozilla", "cvssVector": null, "affected": [ { "product": "Firefox", "range": ">= unspecified / < 50.0.2" }, { "product": "Firefox ESR", "range": ">= unspecified / < 45.5.1" }, { "product": "Thunderbird", "range": ">= unspecified / < 45.5.1" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用してください。", "「CVE-2016-9079」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "label": "CVE：mozilla" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2016-9079", "label": "CVE公式レコード" }, { "url": "https://www.debian.org/security/2016/dsa-3730", "label": "DSA-3730" }, { "url": "http://rhn.redhat.com/errata/RHSA-2016-2843.html", "label": "RHSA-2016:2843" }, { "url": "https://security.gentoo.org/glsa/201701-35", "label": "GLSA-201701-35" }, { "url": "http://www.securitytracker.com/id/1037370", "label": "1037370" }, { "url": "https://www.exploit-db.com/exploits/42327/", "label": "42327" }, { "url": "http://rhn.redhat.com/errata/RHSA-2016-2850.html", "label": "RHSA-2016:2850" }, { "url": "https://www.mozilla.org/security/advisories/mfsa2016-92/", "label": "CVE掲載の参考情報" }, { "url": "http://www.securityfocus.com/bid/94591", "label": "94591" }, { "url": "https://security.gentoo.org/glsa/201701-15", "label": "GLSA-201701-15" }, { "url": "https://www.exploit-db.com/exploits/41151/", "label": "41151" }, { "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9079", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2018-06-11T21:00:00.000Z", "modifiedAt": "2025-10-21T23:45:50.578Z", "fetchedAt": "2026-10-25T05:37:51.137Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Firefox", "vendor": "Mozilla", "versions": [ { "lessThan": "50.0.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Firefox ESR", "vendor": "Mozilla", "versions": [ { "lessThan": "45.5.1", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Thunderbird", "vendor": "Mozilla", "versions": [ { "lessThan": "45.5.1", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2016-9079", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "fetchedAt": "2026-10-25T05:37:51.137Z", "publishedAt": "2018-06-11T21:00:00.000Z", "modifiedAt": "2025-10-21T23:45:50.578Z", "state": "published", "provider": "mozilla", "title": "", "descriptions": [ { "lang": "en", "value": "A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Mozilla", "product": "Firefox", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "unspecified", "lessThan": "50.0.2", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Mozilla", "product": "Firefox ESR", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "unspecified", "lessThan": "45.5.1", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Mozilla", "product": "Thunderbird", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "unspecified", "lessThan": "45.5.1", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Use-after-free in SVG Animation", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.debian.org/security/2016/dsa-3730", "label": "DSA-3730", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://rhn.redhat.com/errata/RHSA-2016-2843.html", "label": "RHSA-2016:2843", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://security.gentoo.org/glsa/201701-35", "label": "GLSA-201701-35", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://www.securitytracker.com/id/1037370", "label": "1037370", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://www.exploit-db.com/exploits/42327/", "label": "42327", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://rhn.redhat.com/errata/RHSA-2016-2850.html", "label": "RHSA-2016:2850", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://www.mozilla.org/security/advisories/mfsa2016-92/", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://www.securityfocus.com/bid/94591", "label": "94591", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://security.gentoo.org/glsa/201701-15", "label": "GLSA-201701-15", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "https://www.exploit-db.com/exploits/41151/", "label": "41151", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1321066", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Firefox\",\"vendor\":\"Mozilla\",\"versions\":[{\"lessThan\":\"50.0.2\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"Firefox ESR\",\"vendor\":\"Mozilla\",\"versions\":[{\"lessThan\":\"45.5.1\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"product\":\"Thunderbird\",\"vendor\":\"Mozilla\",\"versions\":[{\"lessThan\":\"45.5.1\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Use-after-free in SVG Animation\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2016-9079:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "sourcePath": "retained:/originalText", "text": "Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2016-9079:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:45:50.578Z", "fetchedAt": "2026-10-25T05:37:51.137Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "Firefox / Firefox ESR / Thunderbirdに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:37:51.137Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "9baf258267cb7e5bd75d40deb1c96f3f9aa5eebc982f20c8d263108e72e856bf", "sourceModifiedAt": "2025-10-21T23:45:50.578Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SVG アニメーションの use‑after‑free 脆弱性が発見され、Windows 上の Firefox、Firefox ESR、Thunderbird のいずれかを使用しているユーザー、ならびに Tor Browser（Windows）ユーザーを対象とした実際の攻撃が確認されています。また、影響を受けるバージョンは Firefox < 50.0.2、Firefox ESR < 45.5.1、Thunderbird < 45.5.1 です。", "risk": "この脆弱性は実際に悪用が確認されており、対象製品を使用している Windows ユーザーが攻撃を受ける可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2", "E3" ], "applicability": [ { "text": "Windows 上で Firefox、Firefox ESR、または Thunderbird を使用している場合に影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json" ], "evidenceIds": [ "E1" ] }, { "text": "Windows 上の Tor Browser ユーザーも同様に対象となります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Mozilla / Firefox。影響ありとして記載：50.0.2未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Mozilla / Firefox ESR。影響ありとして記載：45.5.1未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Mozilla / Thunderbird。影響ありとして記載：45.5.1未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json" ], "evidenceIds": [ "E6" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json" ], "evidenceIds": [ "E4" ] }, { "text": "「Firefox / Firefox ESR / Thunderbird」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2016-9079", "https://www.debian.org/security/2016/dsa-3730", "http://rhn.redhat.com/errata/RHSA-2016-2843.html", "https://security.gentoo.org/glsa/201701-35", "http://www.securitytracker.com/id/1037370", "https://www.exploit-db.com/exploits/42327/", "http://rhn.redhat.com/errata/RHSA-2016-2850.html", "https://www.mozilla.org/security/advisories/mfsa2016-92/", "http://www.securityfocus.com/bid/94591", "https://security.gentoo.org/glsa/201701-15", "https://www.exploit-db.com/exploits/41151/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079", "https://nvd.nist.gov/vuln/detail/CVE-2016-9079" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079" ], "evidenceIds": [ "E7" ] }, { "text": "「CVE-2016-9079」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2016-9079", "https://www.debian.org/security/2016/dsa-3730", "http://rhn.redhat.com/errata/RHSA-2016-2843.html", "https://security.gentoo.org/glsa/201701-35", "http://www.securitytracker.com/id/1037370", "https://www.exploit-db.com/exploits/42327/", "http://rhn.redhat.com/errata/RHSA-2016-2850.html", "https://www.mozilla.org/security/advisories/mfsa2016-92/", "http://www.securityfocus.com/bid/94591", "https://security.gentoo.org/glsa/201701-15", "https://www.exploit-db.com/exploits/41151/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079", "https://nvd.nist.gov/vuln/detail/CVE-2016-9079" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2016-9079", "https://www.debian.org/security/2016/dsa-3730", "http://rhn.redhat.com/errata/RHSA-2016-2843.html", "https://security.gentoo.org/glsa/201701-35", "http://www.securitytracker.com/id/1037370", "https://www.exploit-db.com/exploits/42327/", "http://rhn.redhat.com/errata/RHSA-2016-2850.html", "https://www.mozilla.org/security/advisories/mfsa2016-92/", "http://www.securityfocus.com/bid/94591", "https://security.gentoo.org/glsa/201701-15", "https://www.exploit-db.com/exploits/41151/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079", "https://nvd.nist.gov/vuln/detail/CVE-2016-9079" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2016-9079", "https://www.debian.org/security/2016/dsa-3730", "http://rhn.redhat.com/errata/RHSA-2016-2843.html", "https://security.gentoo.org/glsa/201701-35", "http://www.securitytracker.com/id/1037370", "https://www.exploit-db.com/exploits/42327/", "http://rhn.redhat.com/errata/RHSA-2016-2850.html", "https://www.mozilla.org/security/advisories/mfsa2016-92/", "http://www.securityfocus.com/bid/94591", "https://security.gentoo.org/glsa/201701-15", "https://www.exploit-db.com/exploits/41151/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079", "https://nvd.nist.gov/vuln/detail/CVE-2016-9079" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2016-9079", "https://www.debian.org/security/2016/dsa-3730", "http://rhn.redhat.com/errata/RHSA-2016-2843.html", "https://security.gentoo.org/glsa/201701-35", "http://www.securitytracker.com/id/1037370", "https://www.exploit-db.com/exploits/42327/", "http://rhn.redhat.com/errata/RHSA-2016-2850.html", "https://www.mozilla.org/security/advisories/mfsa2016-92/", "http://www.securityfocus.com/bid/94591", "https://security.gentoo.org/glsa/201701-15", "https://www.exploit-db.com/exploits/41151/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079", "https://nvd.nist.gov/vuln/detail/CVE-2016-9079" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "label": "CVE：mozilla" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2016-9079", "label": "CVE公式レコード" }, { "url": "https://www.debian.org/security/2016/dsa-3730", "label": "DSA-3730" }, { "url": "http://rhn.redhat.com/errata/RHSA-2016-2843.html", "label": "RHSA-2016:2843" }, { "url": "https://security.gentoo.org/glsa/201701-35", "label": "GLSA-201701-35" }, { "url": "http://www.securitytracker.com/id/1037370", "label": "1037370" }, { "url": "https://www.exploit-db.com/exploits/42327/", "label": "42327" }, { "url": "http://rhn.redhat.com/errata/RHSA-2016-2850.html", "label": "RHSA-2016:2850" }, { "url": "https://www.mozilla.org/security/advisories/mfsa2016-92/", "label": "CVE掲載の参考情報" }, { "url": "http://www.securityfocus.com/bid/94591", "label": "94591" }, { "url": "https://security.gentoo.org/glsa/201701-15", "label": "GLSA-201701-15" }, { "url": "https://www.exploit-db.com/exploits/41151/", "label": "41151" }, { "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9079", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "sourceField": "retained:/originalText", "excerpt": "Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2016-9079\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Firefox\",\"vendor\":\"Mozilla\",\"versions\":[{\"lessThan\":\"50.0.2\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"Firefox ESR\",\"vendor\":\"Mozilla\",\"versions\":[{\"lessThan\":\"45.5.1\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/9xxx/CVE-2016-9079.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"product\":\"Thunderbird\",\"vendor\":\"Mozilla\",\"versions\":[{\"lessThan\":\"45.5.1\",\"status\":\"affected\",\"version\":\"unspecified\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" } ], "supportRequest": "件名：CVE-2016-9079（Firefox / Firefox ESR / Thunderbird）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Windows 上で Firefox、Firefox ESR、または Thunderbird を使用している場合に影響があります。\n・Windows 上の Tor Browser ユーザーも同様に対象となります。\n・公式の対象表：Mozilla / Firefox。影響ありとして記載：50.0.2未満（原資料では開始版が未指定）。\n・公式の対象表：Mozilla / Firefox ESR。影響ありとして記載：45.5.1未満（原資料では開始版が未指定）。\n・公式の対象表：Mozilla / Thunderbird。影響ありとして記載：45.5.1未満（原資料では開始版が未指定）。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2016-9079", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:37:51.137Z", "lastSuccess": "2026-10-25T05:37:51.137Z", "sourceCheckedAt": "2026-10-25T05:37:51.137Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2020-12641", "aliases": [], "title": "n/a：コード実行", "summary": "rcube_image.php において、im_convert_path または im_identify_path の設定にシェルのメタ文字が含まれると、攻撃者が任意のコードを実行できる脆弱性があります。", "risk": "攻撃者はサーバー上で任意のコードを実行できるようになります。", "product": "Roundcube Roundcube Webmail", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用してください。", "「CVE-2020-12641」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-12641", "label": "CVE公式レコード" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4", "label": "CVE掲載の参考情報" }, { "url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube", "label": "CVE掲載の参考情報" }, { "url": "https://security.gentoo.org/glsa/202007-41", "label": "GLSA-202007-41" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html", "label": "openSUSE-SU-2020:1516" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12641", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2020-05-04T14:58:15.000Z", "modifiedAt": "2025-10-21T23:35:44.407Z", "fetchedAt": "2026-10-25T05:37:57.053Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2020-12641", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json", "fetchedAt": "2026-10-25T05:37:57.053Z", "publishedAt": "2020-05-04T14:58:15.000Z", "modifiedAt": "2025-10-21T23:35:44.407Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://security.gentoo.org/glsa/202007-41", "label": "GLSA-202007-41", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html", "label": "openSUSE-SU-2020:1516", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12641", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2020-12641:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "sourcePath": "retained:/originalText", "text": "Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2020-12641:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:35:44.407Z", "fetchedAt": "2026-10-25T05:37:57.053Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:37:57.053Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f632e721472e4b3cbedef8e4268e432f7cd3daa33c44dccdff32b0a53dc5a123", "sourceModifiedAt": "2025-10-21T23:35:44.407Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "rcube_image.php において、im_convert_path または im_identify_path の設定にシェルのメタ文字が含まれると、攻撃者が任意のコードを実行できる脆弱性があります。", "risk": "攻撃者はサーバー上で任意のコードを実行できるようになります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象は Roundcube Webmail の rcube_image.php が使用され、im_convert_path または im_identify_path の設定にシェルメタ文字が含まれている場合です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Roundcube Roundcube Webmail」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-12641", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4", "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4", "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10", "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3", "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube", "https://security.gentoo.org/glsa/202007-41", "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "https://nvd.nist.gov/vuln/detail/CVE-2020-12641" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2020-12641」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2020-12641", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4", "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4", "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10", "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3", "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube", "https://security.gentoo.org/glsa/202007-41", "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "https://nvd.nist.gov/vuln/detail/CVE-2020-12641" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-12641", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4", "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4", "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10", "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3", "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube", "https://security.gentoo.org/glsa/202007-41", "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "https://nvd.nist.gov/vuln/detail/CVE-2020-12641" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2020-12641", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4", "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4", "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10", "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3", "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube", "https://security.gentoo.org/glsa/202007-41", "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "https://nvd.nist.gov/vuln/detail/CVE-2020-12641" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-12641", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4", "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4", "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10", "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3", "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube", "https://security.gentoo.org/glsa/202007-41", "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "https://nvd.nist.gov/vuln/detail/CVE-2020-12641" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-12641", "label": "CVE公式レコード" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4", "label": "CVE掲載の参考情報" }, { "url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube", "label": "CVE掲載の参考情報" }, { "url": "https://security.gentoo.org/glsa/202007-41", "label": "GLSA-202007-41" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html", "label": "openSUSE-SU-2020:1516" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12641", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "sourceField": "retained:/originalText", "excerpt": "Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12641.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "sourceField": "/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2020-12641\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2020-12641（Roundcube Roundcube Webmail）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Roundcube Webmail の rcube_image.php が使用され、im_convert_path または im_identify_path の設定にシェルメタ文字が含まれている場合です。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2020-12641", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:37:57.053Z", "lastSuccess": "2026-10-25T05:37:57.053Z", "sourceCheckedAt": "2026-10-25T05:37:57.053Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2020-35730", "aliases": [], "title": "n/a：ブラウザー上での不正な処理", "summary": "Roundcube Webmail の 1.2.13 未満、1.3 系列の 1.3.16 未満、1.4 系列の 1.4.10 未満に XSS の問題があり、攻撃者はリンク参照要素に JavaScript を埋め込んだプレーンテキストのメールを送信でき、rcube_string_replacer.php の linkref_addindex がそれを誤処理します。", "risk": "被害者のブラウザーで不正なスクリプトが実行され、ページを表示した人のブラウザーで不正な処理が動かされる可能性があります。", "product": "Roundcube Roundcube Webmail", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用してください。", "「CVE-2020-35730」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-35730", "label": "CVE公式レコード" }, { "url": "https://roundcube.net/download/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10", "label": "CVE掲載の参考情報" }, { "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491", "label": "CVE掲載の参考情報" }, { "url": "https://www.alexbirnberg.com/roundcube-xss.html", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13", "label": "CVE掲載の参考情報" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/", "label": "FEDORA-2021-2cb0643316" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/", "label": "FEDORA-2021-73359af51c" }, { "url": "https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35730", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2020-12-28T19:37:08.000Z", "modifiedAt": "2025-10-21T23:35:31.104Z", "fetchedAt": "2026-10-25T05:37:59.363Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2020-35730", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "fetchedAt": "2026-10-25T05:37:59.363Z", "publishedAt": "2020-12-28T19:37:08.000Z", "modifiedAt": "2025-10-21T23:35:31.104Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://roundcube.net/download/", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.alexbirnberg.com/roundcube-xss.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/", "label": "FEDORA-2021-2cb0643316", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/", "label": "FEDORA-2021-73359af51c", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-35730", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":6.1,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"integrityImpact\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"LOW\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2020-35730:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "sourcePath": "retained:/originalText", "text": "Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2020-35730:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:35:31.104Z", "fetchedAt": "2026-10-25T05:37:59.363Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "n/aにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:37:59.363Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "2bb02d38da3773e614dfe326b8d78619f446d34d08f7c42d6c5ee604f59d77fe", "sourceModifiedAt": "2025-10-21T23:35:31.104Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Roundcube Webmail の 1.2.13 未満、1.3 系列の 1.3.16 未満、1.4 系列の 1.4.10 未満に XSS の問題があり、攻撃者はリンク参照要素に JavaScript を埋め込んだプレーンテキストのメールを送信でき、rcube_string_replacer.php の linkref_addindex がそれを誤処理します。", "risk": "被害者のブラウザーで不正なスクリプトが実行され、ページを表示した人のブラウザーで不正な処理が動かされる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "攻撃者がプレーンテキストのメールを送信できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "メール本文中のリンク参照要素に JavaScript を含めることが可能であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Roundcube Webmail が rcube_string_replacer.php の linkref_addindex 関数でリンク参照要素を処理すること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Roundcube Roundcube Webmail」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-35730", "https://roundcube.net/download/", "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491", "https://www.alexbirnberg.com/roundcube-xss.html", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10", "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16", "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13", "https://nvd.nist.gov/vuln/detail/CVE-2020-35730" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2020-35730」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2020-35730", "https://roundcube.net/download/", "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491", "https://www.alexbirnberg.com/roundcube-xss.html", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10", "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16", "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13", "https://nvd.nist.gov/vuln/detail/CVE-2020-35730" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-35730", "https://roundcube.net/download/", "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491", "https://www.alexbirnberg.com/roundcube-xss.html", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10", "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16", "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13", "https://nvd.nist.gov/vuln/detail/CVE-2020-35730" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2020-35730", "https://roundcube.net/download/", "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491", "https://www.alexbirnberg.com/roundcube-xss.html", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10", "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16", "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13", "https://nvd.nist.gov/vuln/detail/CVE-2020-35730" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-35730", "https://roundcube.net/download/", "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491", "https://www.alexbirnberg.com/roundcube-xss.html", "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10", "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16", "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13", "https://nvd.nist.gov/vuln/detail/CVE-2020-35730" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-35730", "label": "CVE公式レコード" }, { "url": "https://roundcube.net/download/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10", "label": "CVE掲載の参考情報" }, { "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491", "label": "CVE掲載の参考情報" }, { "url": "https://www.alexbirnberg.com/roundcube-xss.html", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13", "label": "CVE掲載の参考情報" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/", "label": "FEDORA-2021-2cb0643316" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/", "label": "FEDORA-2021-73359af51c" }, { "url": "https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35730", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "sourceField": "retained:/originalText", "excerpt": "Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35730.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "sourceField": "/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2020-35730\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2020-35730（Roundcube Roundcube Webmail）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者がプレーンテキストのメールを送信できること。\n・メール本文中のリンク参照要素に JavaScript を含めることが可能であること。\n・Roundcube Webmail が rcube_string_replacer.php の linkref_addindex 関数でリンク参照要素を処理すること。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2020-35730", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:37:59.363Z", "lastSuccess": "2026-10-25T05:37:59.363Z", "sourceCheckedAt": "2026-10-25T05:37:59.363Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2021-44026", "aliases": [], "title": "n/a：データベースへの不正操作", "summary": "Roundcube Webmail の 1.3.17 未満および 1.4 系列の 1.4.12 未満のバージョンは、search または search_params 機能を通じて SQL インジェクションが発生する可能性があります。", "risk": "SQL インジェクションが実行可能になる可能性があります。", "product": "Roundcube Roundcube Webmail", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用する。", "「CVE-2021-44026」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-44026", "label": "CVE公式レコード" }, { "url": "https://bugs.debian.org/1000156", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa", "label": "CVE掲載の参考情報" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/", "label": "FEDORA-2021-167865df98" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/", "label": "FEDORA-2021-43d3c10590" }, { "url": "https://www.debian.org/security/2021/dsa-5013", "label": "DSA-5013" }, { "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html", "label": "[debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update" }, { "url": "https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44026", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2021-11-19T03:47:27.000Z", "modifiedAt": "2025-10-21T23:25:24.717Z", "fetchedAt": "2026-10-25T05:38:02.124Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2021-44026", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json", "fetchedAt": "2026-10-25T05:38:02.124Z", "publishedAt": "2021-11-19T03:47:27.000Z", "modifiedAt": "2025-10-21T23:25:24.717Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Roundcube Webmail is vulnerable to SQL injection via search or search_params.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://bugs.debian.org/1000156", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/", "label": "FEDORA-2021-167865df98", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/", "label": "FEDORA-2021-43d3c10590", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://www.debian.org/security/2021/dsa-5013", "label": "DSA-5013", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html", "label": "[debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44026", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2021-44026:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "sourcePath": "retained:/originalText", "text": "Roundcube Webmail is vulnerable to SQL injection via search or search_params.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2021-44026:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:25:24.717Z", "fetchedAt": "2026-10-25T05:38:02.124Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "n/aにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:38:02.124Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "27a26dbbfb0f42b2b716fca85d2e28abc5747d36be91038255ca863de8659198", "sourceModifiedAt": "2025-10-21T23:25:24.717Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Roundcube Webmail の 1.3.17 未満および 1.4 系列の 1.4.12 未満のバージョンは、search または search_params 機能を通じて SQL インジェクションが発生する可能性があります。", "risk": "SQL インジェクションが実行可能になる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "Roundcube 1.3.17 未満および 1.4 系列の 1.4.12 未満が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json" ], "evidenceIds": [ "E1" ] }, { "text": "search または search_params 機能が利用可能な状態であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Roundcube Roundcube Webmail」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-44026", "https://bugs.debian.org/1000156", "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1", "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/", "https://www.debian.org/security/2021/dsa-5013", "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released", "https://nvd.nist.gov/vuln/detail/CVE-2021-44026" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2021-44026」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2021-44026", "https://bugs.debian.org/1000156", "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1", "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/", "https://www.debian.org/security/2021/dsa-5013", "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released", "https://nvd.nist.gov/vuln/detail/CVE-2021-44026" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-44026", "https://bugs.debian.org/1000156", "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1", "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/", "https://www.debian.org/security/2021/dsa-5013", "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released", "https://nvd.nist.gov/vuln/detail/CVE-2021-44026" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2021-44026", "https://bugs.debian.org/1000156", "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1", "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/", "https://www.debian.org/security/2021/dsa-5013", "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released", "https://nvd.nist.gov/vuln/detail/CVE-2021-44026" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-44026", "https://bugs.debian.org/1000156", "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1", "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/", "https://www.debian.org/security/2021/dsa-5013", "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released", "https://nvd.nist.gov/vuln/detail/CVE-2021-44026" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-44026", "label": "CVE公式レコード" }, { "url": "https://bugs.debian.org/1000156", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa", "label": "CVE掲載の参考情報" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/", "label": "FEDORA-2021-167865df98" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/", "label": "FEDORA-2021-43d3c10590" }, { "url": "https://www.debian.org/security/2021/dsa-5013", "label": "DSA-5013" }, { "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html", "label": "[debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update" }, { "url": "https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44026", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "sourceField": "retained:/originalText", "excerpt": "Roundcube Webmail is vulnerable to SQL injection via search or search_params.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44026.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "sourceField": "/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2021-44026\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2021-44026（Roundcube Roundcube Webmail）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Roundcube 1.3.17 未満および 1.4 系列の 1.4.12 未満が対象です。\n・search または search_params 機能が利用可能な状態であること。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2021-44026", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:38:02.124Z", "lastSuccess": "2026-10-25T05:38:02.124Z", "sourceCheckedAt": "2026-10-25T05:38:02.124Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-20887", "aliases": [], "title": "Aria Operations for Networks (Formerly vRealize Network Insight)：コード実行", "summary": "Aria Operations for Networks にはコマンドインジェクションの脆弱性があり、ネットワーク上でこの製品にアクセスできる攻撃者がコマンドインジェクションを実行し、リモートでコードを実行させられる可能性があります。", "risk": "攻撃者がリモートでコードを実行できるため、サーバー上で任意の処理が行われる危険があります。", "product": "Aria Operations for Networks (Formerly vRealize Network Insight)", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "vmware", "cvssVector": null, "affected": [ { "product": "Aria Operations for Networks (Formerly vRealize Network Insight)", "range": "Aria Operations for Networks (Formerly vRealize Network Insight) 6.x" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用してください。", "「CVE-2023-20887」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json", "label": "CVE：vmware" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-20887", "label": "CVE公式レコード" }, { "url": "https://www.vmware.com/security/advisories/VMSA-2023-0012.html", "label": "CISAが示す関連情報" }, { "url": "http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20887", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-06-07T14:16:56.641Z", "modifiedAt": "2025-10-21T23:05:46.461Z", "fetchedAt": "2026-10-25T05:58:09.027Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Aria Operations for Networks (Formerly vRealize Network Insight)", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Aria Operations for Networks (Formerly vRealize Network Insight) 6.x" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-20887", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json", "fetchedAt": "2026-10-25T05:58:09.027Z", "publishedAt": "2023-06-07T14:16:56.641Z", "modifiedAt": "2025-10-21T23:05:46.461Z", "state": "published", "provider": "vmware", "title": "", "descriptions": [ { "lang": "en", "value": "Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "Aria Operations for Networks (Formerly vRealize Network Insight)", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "Aria Operations for Networks (Formerly vRealize Network Insight) 6.x", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Networks Command Injection Vulnerability", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.vmware.com/security/advisories/VMSA-2023-0012.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20887", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Aria Operations for Networks (Formerly vRealize Network Insight)\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"Aria Operations for Networks (Formerly vRealize Network Insight) 6.x\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Networks Command Injection Vulnerability\",\"lang\":\"en\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-20887:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "sourcePath": "retained:/originalText", "text": "VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-20887:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:46.461Z", "fetchedAt": "2026-10-25T05:58:09.027Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "Aria Operations for Networks (Formerly vRealize Network Insight)にコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:58:09.027Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e2488205472c0347b9381e24bab73c683e8c9fbba21da21ad4c83ae9c5b52eed", "sourceModifiedAt": "2025-10-21T23:05:46.461Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Aria Operations for Networks にはコマンドインジェクションの脆弱性があり、ネットワーク上でこの製品にアクセスできる攻撃者がコマンドインジェクションを実行し、リモートでコードを実行させられる可能性があります。", "risk": "攻撃者がリモートでコードを実行できるため、サーバー上で任意の処理が行われる危険があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "攻撃者がネットワーク上で VMware Aria Operations for Networks にアクセスできることが前提条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Aria Operations for Networks (Formerly vRealize Network Insight)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-20887", "https://www.vmware.com/security/advisories/VMSA-2023-0012.html", "http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "https://nvd.nist.gov/vuln/detail/CVE-2023-20887" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2023-20887」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-20887", "https://www.vmware.com/security/advisories/VMSA-2023-0012.html", "http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "https://nvd.nist.gov/vuln/detail/CVE-2023-20887" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-20887", "https://www.vmware.com/security/advisories/VMSA-2023-0012.html", "http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "https://nvd.nist.gov/vuln/detail/CVE-2023-20887" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-20887", "https://www.vmware.com/security/advisories/VMSA-2023-0012.html", "http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "https://nvd.nist.gov/vuln/detail/CVE-2023-20887" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-20887", "https://www.vmware.com/security/advisories/VMSA-2023-0012.html", "http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "https://nvd.nist.gov/vuln/detail/CVE-2023-20887" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json", "label": "CVE：vmware" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-20887", "label": "CVE公式レコード" }, { "url": "https://www.vmware.com/security/advisories/VMSA-2023-0012.html", "label": "CISAが示す関連情報" }, { "url": "http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20887", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "sourceField": "retained:/originalText", "excerpt": "VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/20xxx/CVE-2023-20887.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Aria Operations for Networks (Formerly vRealize Network Insight)\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"Aria Operations for Networks (Formerly vRealize Network Insight) 6.x\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "sourceField": "/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20887", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-20887\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-20887（Aria Operations for Networks (Formerly vRealize Network Insight)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者がネットワーク上で VMware Aria Operations for Networks にアクセスできることが前提条件です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-20887", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:58:09.027Z", "lastSuccess": "2026-10-25T05:58:09.027Z", "sourceCheckedAt": "2026-10-25T05:58:09.027Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-27997", "aliases": [], "title": "FortiOS-6K7K / FortiProxy / FortiOS：コード実行", "summary": "FortiOS（バージョン7.2.4以下、7.0.11以下、6.4.12以下、6.0.16以下）および FortiProxy（バージョン7.2.3以下、7.0.9以下、2.0.12以下、1.2全バージョン、1.1全バージョン）の SSL‑VPN において、ヒープベースのバッファオーバーフロー（CWE‑122）が存在し、特別に細工したリクエストを送ることで、リモートの攻撃者が任意のコードやコマンドを実行できる可能性があります。", "risk": "この脆弱性が悪用されると、認証されていないリモート攻撃者がサーバー上で任意のコードやコマンドを実行できるようになります。", "product": "FortiOS-6K7K / FortiProxy / FortiOS", "category": "other", "component": "package", "severity": "critical", "cvss": 9.2, "cvssVersion": "3.1", "cvssSource": "fortinet", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R", "affected": [ { "product": "FortiOS-6K7K", "range": "7.0.10" }, { "product": "FortiOS-6K7K", "range": "7.0.5" }, { "product": "FortiOS-6K7K", "range": "6.4.12" }, { "product": "FortiOS-6K7K", "range": "6.4.10" }, { "product": "FortiOS-6K7K", "range": "6.4.8" }, { "product": "FortiOS-6K7K", "range": "6.4.6" }, { "product": "FortiOS-6K7K", "range": "6.4.2" }, { "product": "FortiOS-6K7K", "range": ">= 6.2.9 / <= 6.2.13" }, { "product": "FortiOS-6K7K", "range": ">= 6.2.6 / <= 6.2.7" }, { "product": "FortiOS-6K7K", "range": "6.2.4" }, { "product": "FortiOS-6K7K", "range": ">= 6.0.12 / <= 6.0.16" }, { "product": "FortiOS-6K7K", "range": "6.0.10" }, { "product": "FortiProxy", "range": ">= 7.2.0 / <= 7.2.3" }, { "product": "FortiProxy", "range": ">= 7.0.0 / <= 7.0.9" }, { "product": "FortiProxy", "range": ">= 2.0.0 / <= 2.0.12" }, { "product": "FortiProxy", "range": ">= 1.2.0 / <= 1.2.13" }, { "product": "FortiProxy", "range": ">= 1.1.0 / <= 1.1.6" }, { "product": "FortiOS", "range": ">= 7.2.0 / <= 7.2.4" }, { "product": "FortiOS", "range": ">= 7.0.0 / <= 7.0.11" }, { "product": "FortiOS", "range": ">= 6.4.0 / <= 6.4.12" }, { "product": "FortiOS", "range": ">= 6.2.0 / <= 6.2.13" }, { "product": "FortiOS", "range": ">= 6.0.0 / <= 6.0.16" } ], "fixed": [], "steps": [ "FortiOS‑6K7K をバージョン 7.0.12 以上、6.4.13 以上、6.2.15 以上、6.0.17 以上にアップグレードしてください。また、FortiProxy をバージョン 7.2.4 以上、7.0.10 以上に、FortiOS をバージョン 7.4.0 以上、7.2.5 以上、7.0.12 以上、6.4.13 以上、6.2.14 以上、6.0.17 以上にアップグレードしてください。", "「CVE-2023-27997」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997", "label": "CVE公式レコード" }, { "url": "https://fortiguard.com/psirt/FG-IR-23-097", "label": "https://fortiguard.com/psirt/FG-IR-23-097" }, { "url": "https://www.fortiguard.com/psirt/FG-IR-23-097", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27997", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-06-13T08:41:47.415Z", "modifiedAt": "2026-07-31T03:55:27.798Z", "fetchedAt": "2026-10-25T05:38:11.484Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Fortinet", "product": "FortiOS-6K7K", "defaultStatus": "unaffected", "versions": [ { "version": "7.0.10", "status": "affected" }, { "version": "7.0.5", "status": "affected" }, { "version": "6.4.12", "status": "affected" }, { "version": "6.4.10", "status": "affected" }, { "version": "6.4.8", "status": "affected" }, { "version": "6.4.6", "status": "affected" }, { "version": "6.4.2", "status": "affected" }, { "versionType": "semver", "version": "6.2.9", "lessThanOrEqual": "6.2.13", "status": "affected" }, { "versionType": "semver", "version": "6.2.6", "lessThanOrEqual": "6.2.7", "status": "affected" }, { "version": "6.2.4", "status": "affected" }, { "versionType": "semver", "version": "6.0.12", "lessThanOrEqual": "6.0.16", "status": "affected" }, { "version": "6.0.10", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiProxy", "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.3", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.9", "status": "affected" }, { "versionType": "semver", "version": "2.0.0", "lessThanOrEqual": "2.0.12", "status": "affected" }, { "versionType": "semver", "version": "1.2.0", "lessThanOrEqual": "1.2.13", "status": "affected" }, { "versionType": "semver", "version": "1.1.0", "lessThanOrEqual": "1.1.6", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiOS", "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.4", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.11", "status": "affected" }, { "versionType": "semver", "version": "6.4.0", "lessThanOrEqual": "6.4.12", "status": "affected" }, { "versionType": "semver", "version": "6.2.0", "lessThanOrEqual": "6.2.13", "status": "affected" }, { "versionType": "semver", "version": "6.0.0", "lessThanOrEqual": "6.0.16", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-27997", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "fetchedAt": "2026-10-25T05:38:11.484Z", "publishedAt": "2023-06-13T08:41:47.415Z", "modifiedAt": "2026-07-31T03:55:27.798Z", "state": "published", "provider": "fortinet", "title": "", "descriptions": [ { "lang": "en", "value": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Fortinet", "product": "FortiOS-6K7K", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.0.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.0.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "6.4.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "6.4.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "6.4.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "6.4.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "6.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "6.2.9", "lessThanOrEqual": "6.2.13", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "6.2.6", "lessThanOrEqual": "6.2.7", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "6.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "6.0.12", "lessThanOrEqual": "6.0.16", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "6.0.10", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiProxy", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "7.2.0", "lessThanOrEqual": "7.2.3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "7.0.0", "lessThanOrEqual": "7.0.9", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "2.0.0", "lessThanOrEqual": "2.0.12", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "1.2.0", "lessThanOrEqual": "1.2.13", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "1.1.0", "lessThanOrEqual": "1.1.6", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiOS", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "7.2.0", "lessThanOrEqual": "7.2.4", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/1", "version": "7.0.0", "lessThanOrEqual": "7.0.11", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/2", "version": "6.4.0", "lessThanOrEqual": "6.4.12", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/3", "version": "6.2.0", "lessThanOrEqual": "6.2.13", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/4", "version": "6.0.0", "lessThanOrEqual": "6.0.16", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Please upgrade to FortiOS-6K7K version 7.0.12 or above\r\nPlease upgrade to FortiOS-6K7K version 6.4.13 or above\r\nPlease upgrade to FortiOS-6K7K version 6.2.15 or above\r\nPlease upgrade to FortiOS-6K7K version 6.0.17 or above\r\nPlease upgrade to FortiProxy version 7.2.4 or above\r\nPlease upgrade to FortiProxy version 7.0.10 or above\r\nPlease upgrade to FortiOS version 7.4.0 or above\r\nPlease upgrade to FortiOS version 7.2.5 or above\r\nPlease upgrade to FortiOS version 7.0.12 or above\r\nPlease upgrade to FortiOS version 6.4.13 or above\r\nPlease upgrade to FortiOS version 6.2.14 or above\r\nPlease upgrade to FortiOS version 6.0.17 or above", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-122", "lang": "en", "description": "Execute unauthorized code or commands", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R", "baseScore": 9.2, "baseSeverity": "CRITICAL", "provider": "fortinet", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://fortiguard.com/psirt/FG-IR-23-097", "label": "https://fortiguard.com/psirt/FG-IR-23-097", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS-6K7K\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"7.0.10\",\"status\":\"affected\"},{\"version\":\"7.0.5\",\"status\":\"affected\"},{\"version\":\"6.4.12\",\"status\":\"affected\"},{\"version\":\"6.4.10\",\"status\":\"affected\"},{\"version\":\"6.4.8\",\"status\":\"affected\"},{\"version\":\"6.4.6\",\"status\":\"affected\"},{\"version\":\"6.4.2\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.2.9\",\"lessThanOrEqual\":\"6.2.13\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.2.6\",\"lessThanOrEqual\":\"6.2.7\",\"status\":\"affected\"},{\"version\":\"6.2.4\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.0.12\",\"lessThanOrEqual\":\"6.0.16\",\"status\":\"affected\"},{\"version\":\"6.0.10\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiProxy\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.3\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.9\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"2.0.0\",\"lessThanOrEqual\":\"2.0.12\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.2.0\",\"lessThanOrEqual\":\"1.2.13\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.1.0\",\"lessThanOrEqual\":\"1.1.6\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.4\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.11\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.4.0\",\"lessThanOrEqual\":\"6.4.12\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.2.0\",\"lessThanOrEqual\":\"6.2.13\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.0.0\",\"lessThanOrEqual\":\"6.0.16\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Please upgrade to FortiOS-6K7K version 7.0.12 or above\r\nPlease upgrade to FortiOS-6K7K version 6.4.13 or above\r\nPlease upgrade to FortiOS-6K7K version 6.2.15 or above\r\nPlease upgrade to FortiOS-6K7K version 6.0.17 or above\r\nPlease upgrade to FortiProxy version 7.2.4 or above\r\nPlease upgrade to FortiProxy version 7.0.10 or above\r\nPlease upgrade to FortiOS version 7.4.0 or above\r\nPlease upgrade to FortiOS version 7.2.5 or above\r\nPlease upgrade to FortiOS version 7.0.12 or above\r\nPlease upgrade to FortiOS version 6.4.13 or above\r\nPlease upgrade to FortiOS version 6.2.14 or above\r\nPlease upgrade to FortiOS version 6.0.17 or above", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-122\",\"description\":\"Execute unauthorized code or commands\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.2,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-27997:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "sourcePath": "retained:/originalText", "text": "Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-27997:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "modifiedAt": "2023-06-13T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-31T03:55:27.798Z", "fetchedAt": "2026-10-25T05:38:11.484Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-13T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "FortiOS-6K7K / FortiProxy / FortiOSにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:38:11.484Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "67442b205edde3e6b903212c789e2626a510dc6f5fbcb63d88fc170c46886249", "sourceModifiedAt": "2026-07-31T03:55:27.798Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "FortiOS（バージョン7.2.4以下、7.0.11以下、6.4.12以下、6.0.16以下）および FortiProxy（バージョン7.2.3以下、7.0.9以下、2.0.12以下、1.2全バージョン、1.1全バージョン）の SSL‑VPN において、ヒープベースのバッファオーバーフロー（CWE‑122）が存在し、特別に細工したリクエストを送ることで、リモートの攻撃者が任意のコードやコマンドを実行できる可能性があります。", "risk": "この脆弱性が悪用されると、認証されていないリモート攻撃者がサーバー上で任意のコードやコマンドを実行できるようになります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者は認証されていないリモートの存在である必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象となる機能は SSL‑VPN であり、攻撃は特別に細工したリクエストを送信することで実行されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Fortinet / FortiOS-6K7K。影響ありとして記載：7.0.10。影響ありとして記載：7.0.5。影響ありとして記載：6.4.12。影響ありとして記載：6.4.10。影響ありとして記載：6.4.8。影響ありとして記載：6.4.6。影響ありとして記載：6.4.2。影響ありとして記載：6.2.9以上、6.2.13以下。影響ありとして記載：6.2.6以上、6.2.7以下。影響ありとして記載：6.2.4。影響ありとして記載：6.0.12以上、6.0.16以下。影響ありとして記載：6.0.10。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Fortinet / FortiProxy。影響ありとして記載：7.2.0以上、7.2.3以下。影響ありとして記載：7.0.0以上、7.0.9以下。影響ありとして記載：2.0.0以上、2.0.12以下。影響ありとして記載：1.2.0以上、1.2.13以下。影響ありとして記載：1.1.0以上、1.1.6以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.2.0以上、7.2.4以下。影響ありとして記載：7.0.0以上、7.0.11以下。影響ありとして記載：6.4.0以上、6.4.12以下。影響ありとして記載：6.2.0以上、6.2.13以下。影響ありとして記載：6.0.0以上、6.0.16以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json" ], "evidenceIds": [ "E2" ] }, { "text": "「FortiOS-6K7K / FortiProxy / FortiOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-27997", "https://fortiguard.com/psirt/FG-IR-23-097", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "https://www.fortiguard.com/psirt/FG-IR-23-097", "https://nvd.nist.gov/vuln/detail/CVE-2023-27997" ] } ], "actions": [ { "text": "FortiOS‑6K7K をバージョン 7.0.12 以上、6.4.13 以上、6.2.15 以上、6.0.17 以上にアップグレードしてください。また、FortiProxy をバージョン 7.2.4 以上、7.0.10 以上に、FortiOS をバージョン 7.4.0 以上、7.2.5 以上、7.0.12 以上、6.4.13 以上、6.2.14 以上、6.0.17 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json" ], "evidenceIds": [ "E5" ] }, { "text": "「CVE-2023-27997」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-27997", "https://fortiguard.com/psirt/FG-IR-23-097", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "https://www.fortiguard.com/psirt/FG-IR-23-097", "https://nvd.nist.gov/vuln/detail/CVE-2023-27997" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-27997", "https://fortiguard.com/psirt/FG-IR-23-097", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "https://www.fortiguard.com/psirt/FG-IR-23-097", "https://nvd.nist.gov/vuln/detail/CVE-2023-27997" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-27997", "https://fortiguard.com/psirt/FG-IR-23-097", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "https://www.fortiguard.com/psirt/FG-IR-23-097", "https://nvd.nist.gov/vuln/detail/CVE-2023-27997" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-27997", "https://fortiguard.com/psirt/FG-IR-23-097", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "https://www.fortiguard.com/psirt/FG-IR-23-097", "https://nvd.nist.gov/vuln/detail/CVE-2023-27997" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997", "label": "CVE公式レコード" }, { "url": "https://fortiguard.com/psirt/FG-IR-23-097", "label": "https://fortiguard.com/psirt/FG-IR-23-097" }, { "url": "https://www.fortiguard.com/psirt/FG-IR-23-097", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27997", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS-6K7K\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"7.0.10\",\"status\":\"affected\"},{\"version\":\"7.0.5\",\"status\":\"affected\"},{\"version\":\"6.4.12\",\"status\":\"affected\"},{\"version\":\"6.4.10\",\"status\":\"affected\"},{\"version\":\"6.4.8\",\"status\":\"affected\"},{\"version\":\"6.4.6\",\"status\":\"affected\"},{\"version\":\"6.4.2\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.2.9\",\"lessThanOrEqual\":\"6.2.13\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.2.6\",\"lessThanOrEqual\":\"6.2.7\",\"status\":\"affected\"},{\"version\":\"6.2.4\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.0.12\",\"lessThanOrEqual\":\"6.0.16\",\"status\":\"affected\"},{\"version\":\"6.0.10\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiProxy\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.3\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.9\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"2.0.0\",\"lessThanOrEqual\":\"2.0.12\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.2.0\",\"lessThanOrEqual\":\"1.2.13\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.1.0\",\"lessThanOrEqual\":\"1.1.6\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.4\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.11\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.4.0\",\"lessThanOrEqual\":\"6.4.12\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.2.0\",\"lessThanOrEqual\":\"6.2.13\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.0.0\",\"lessThanOrEqual\":\"6.0.16\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/27xxx/CVE-2023-27997.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Please upgrade to FortiOS-6K7K version 7.0.12 or above\r\nPlease upgrade to FortiOS-6K7K version 6.4.13 or above\r\nPlease upgrade to FortiOS-6K7K version 6.2.15 or above\r\nPlease upgrade to FortiOS-6K7K version 6.0.17 or above\r\nPlease upgrade to FortiProxy version 7.2.4 or above\r\nPlease upgrade to FortiProxy version 7.0.10 or above\r\nPlease upgrade to FortiOS version 7.4.0 or above\r\nPlease upgrade to FortiOS version 7.2.5 or above\r\nPlease upgrade to FortiOS version 7.0.12 or above\r\nPlease upgrade to FortiOS version 6.4.13 or above\r\nPlease upgrade to FortiOS version 6.2.14 or above\r\nPlease upgrade to FortiOS version 6.0.17 or above", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-27997\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-27997（FortiOS-6K7K / FortiProxy / FortiOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者は認証されていないリモートの存在である必要があります。\n・対象となる機能は SSL‑VPN であり、攻撃は特別に細工したリクエストを送信することで実行されます。\n・公式の対象表：Fortinet / FortiOS-6K7K。影響ありとして記載：7.0.10。影響ありとして記載：7.0.5。影響ありとして記載：6.4.12。影響ありとして記載：6.4.10。影響ありとして記載：6.4.8。影響ありとして記載：6.4.6。影響ありとして記載：6.4.2。影響ありとして記載：6.2.9以上、6.2.13以下。影響ありとして記載：6.2.6以上、6.2.7以下。影響ありとして記載：6.2.4。影響ありとして記載：6.0.12以上、6.0.16以下。影響ありとして記載：6.0.10。\n・公式の対象表：Fortinet / FortiProxy。影響ありとして記載：7.2.0以上、7.2.3以下。影響ありとして記載：7.0.0以上、7.0.9以下。影響ありとして記載：2.0.0以上、2.0.12以下。影響ありとして記載：1.2.0以上、1.2.13以下。影響ありとして記載：1.1.0以上、1.1.6以下。\n・公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.2.0以上、7.2.4以下。影響ありとして記載：7.0.0以上、7.0.11以下。影響ありとして記載：6.4.0以上、6.4.12以下。影響ありとして記載：6.2.0以上、6.2.13以下。影響ありとして記載：6.0.0以上、6.0.16以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-27997", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:38:11.484Z", "lastSuccess": "2026-10-25T05:38:11.484Z", "sourceCheckedAt": "2026-10-25T05:38:11.484Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-3247", "aliases": [ "GHSA-76gg-c692-v2mw" ], "title": "PHP：脆弱性情報", "summary": "PHP 8.0.*（8.0.29 未満）、8.1.*（8.1.20 未満）、8.2.*（8.2.7 未満）で SOAP HTTP Digest 認証を使用すると、乱数生成関数の失敗チェックが行われず、使用される乱数のビット数が本来より狭くなります。乱数生成が失敗した場合、クライアント側の未初期化メモリ 31 ビットがサーバーに送信され情報が漏洩し、さらに悪意あるサーバーがクライアントの nonce を推測しやすくなります。", "risk": "情報漏洩によりクライアントのスタックから 31 ビットの未初期化メモリがサーバーに送られ、悪意あるサーバーがクライアントの nonce を推測しやすくなる可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "low", "cvss": 2.6, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "affected": [ { "product": "PHP", "range": "8.0.* / < 8.0.29" }, { "product": "PHP", "range": "8.1.* / < 8.1.20" }, { "product": "PHP", "range": "8.2.* / < 8.2.7" } ], "fixed": [ "8.0.29", "8.1.20", "8.2.7" ], "steps": [ "PHP 8.0.29、8.1.20、8.2.7 で提供されるパッチを適用すると、nonce のサイズが拡大され、php_random_bytes_throw の戻り値がチェックされるようになり、問題が修正されます。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-3247", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2023-06-12T14:20:53.000Z", "modifiedAt": "2024-10-15T20:34:03.327Z", "fetchedAt": "2026-10-25T05:38:13.662Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.", "sourceTitle": "Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "PHP", "vendor": "PHP Group", "versions": [ { "lessThan": "8.0.29", "status": "affected", "version": "8.0.*", "versionType": "semver" }, { "lessThan": "8.1.20", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.7", "status": "affected", "version": "8.2.*", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-3247", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "fetchedAt": "2026-10-25T05:38:13.662Z", "publishedAt": "2023-07-22T04:17:09.896Z", "modifiedAt": "2024-10-15T20:34:03.327Z", "state": "published", "provider": "php", "title": "Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "**This report was co-authored by @timwolla**\n\n### Summary\r\n\r\nThe random byte generation function used in the SOAP HTTP Digest authentication code is not checked for failure. This can result in a stack information leak. Furthermore, there's an insufficient number of random bytes used.\n\n### Details\r\n\r\nContext: https://github.com/php/php-src/blob/af809ef028e1e3ed59284e2506cab0f275b55d8e/ext/soap/php_http.c#L664-L671\r\n\r\nIf `php_random_bytes_throw` fails, the nonce will be uninitialized, but\r\nstill sent to the server. The client nonce is intended to protect\r\nagainst a malicious server. See section 5.10 and 5.12 of [RFC 7616](https://www.rfc-editor.org/rfc/rfc7616),\r\nand bullet point 2 below.\r\n\r\nTim pointed out that even though it's the MD5 of the nonce that gets sent,\r\nenumerating 31 bits is trivial. So we have still a stack information leak\r\nof 31 bits.\r\n\r\nFurthermore, Tim found the following issues:\r\n* The small size of cnonce might cause the server to erroneously reject\r\n a request due to a repeated (cnonce, nc) pair. As per the birthday\r\n problem 31 bits of randomness will return a duplication with 50%\r\n chance after less than 55000 requests and nc always starts counting at 1.\r\n* The cnonce is intended to protect the client and password against a\r\n malicious server that returns a constant server nonce where the server\r\n precomputed a rainbow table between passwords and correct client response.\r\n As storage is fairly cheap, a server could precompute the client responses\r\n for (a subset of) client nonces and still have a chance of reversing the\r\n client response with the same probability as the cnonce duplication.\r\n\r\n Precomputing the rainbow table for all 2^31 cnonces increases the rainbow\r\n table size by factor 2 billion, which is infeasible. But precomputing it\r\n for 2^14 cnonces only increases the table size by factor 16k and the server\r\n would still have a 10% chance of successfully reversing a password with a\r\n single client request.\n\n### Impact\r\n\r\nThe weak randomness affects applications that use SOAP with HTTP Digest authentication against a possibly malicious server over HTTP. The stack information leak applies to both HTTP and HTTPS, but is only a few bytes.\n\n### Proposed patch\r\n\r\nThis patch fixes the issues by increasing the nonce size, and checking\r\nthe return value of php_random_bytes_throw(). In the process we also get\r\nrid of the MD5 hashing of the nonce.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.0.*", "lessThan": "8.0.29", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.1.*", "lessThan": "8.1.20", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.2.*", "lessThan": "8.2.7", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.0.29; patched versions: 8.0.29", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.1.20; patched versions: 8.1.20", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.7; patched versions: 8.2.7", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-252", "lang": "en", "description": "CWE-252 Unchecked Return Value", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-330", "lang": "en", "description": "CWE-330 Use of Insufficiently Random Values", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "baseScore": 2.6, "baseSeverity": "LOW", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.0.29\",\"status\":\"affected\",\"version\":\"8.0.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.1.20\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.7\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-252\",\"description\":\"CWE-252 Unchecked Return Value\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-330\",\"description\":\"CWE-330 Use of Insufficiently Random Values\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":2.6,\"baseSeverity\":\"LOW\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"LOW\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"REQUIRED\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-76gg-c692-v2mw:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw", "sourcePath": "/description", "text": "**This report was co-authored by @timwolla**\n\n### Summary\r\n\r\nThe random byte generation function used in the SOAP HTTP Digest authentication code is not checked for failure. This can result in a stack information leak. Furthermore, there's an insufficient number of random bytes used.\n\n### Details\r\n\r\nContext: https://github.com/php/php-src/blob/af809ef028e1e3ed59284e2506cab0f275b55d8e/ext/soap/php_http.c#L664-L671\r\n\r\nIf `php_random_bytes_throw` fails, the nonce will be uninitialized, but\r\nstill sent to the server. The client nonce is intended to protect\r\nagainst a malicious server. See section 5.10 and 5.12 of [RFC 7616](https://www.rfc-editor.org/rfc/rfc7616),\r\nand bullet point 2 below.\r\n\r\nTim pointed out that even though it's the MD5 of the nonce that gets sent,\r\nenumerating 31 bits is trivial. So we have still a stack information leak\r\nof 31 bits.\r\n\r\nFurthermore, Tim found the following issues:\r\n* The small size of cnonce might cause the server to erroneously reject\r\n a request due to a repeated (cnonce, nc) pair. As per the birthday\r\n problem 31 bits of randomness will return a duplication with 50%\r\n chance after less than 55000 requests and nc always starts counting at 1.\r\n* The cnonce is intended to protect the client and password against a\r\n malicious server that returns a constant server nonce where the server\r\n precomputed a rainbow table between passwords and correct client response.\r\n As storage is fairly cheap, a server could precompute the client responses\r\n for (a subset of) client nonces and still have a chance of reversing the\r\n client response with the same probability as the cnonce duplication.\r\n\r\n Precomputing the rainbow table for all 2^31 cnonces increases the rainbow\r\n table size by factor 2 billion, which is infeasible. But precomputing it\r\n for 2^14 cnonces only increases the table size by factor 16k and the server\r\n would still have a 10% chance of successfully reversing a password with a\r\n single client request.\n\n### Impact\r\n\r\nThe weak randomness affects applications that use SOAP with HTTP Digest authentication against a possibly malicious server over HTTP. The stack information leak applies to both HTTP and HTTPS, but is only a few bytes.\n\n### Proposed patch\r\n\r\nThis patch fixes the issues by increasing the nonce size, and checking\r\nthe return value of php_random_bytes_throw(). In the process we also get\r\nrid of the MD5 hashing of the nonce.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-76gg-c692-v2mw:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.0.29\",\"patched_versions\":\"8.0.29\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-76gg-c692-v2mw:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.1.20\",\"patched_versions\":\"8.1.20\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-76gg-c692-v2mw:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"\",\"name\":\"\"},\"vulnerable_version_range\":\"< 8.2.7\",\"patched_versions\":\"8.2.7\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2024-10-15T20:34:03.327Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw", "modifiedAt": "2023-06-14T16:25:35.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2024-10-15T20:34:03.327Z", "fetchedAt": "2026-10-25T05:38:13.662Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2023-06-14T16:25:35.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:38:13.662Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e595851d5e2abda208bfc992ce7e7998653ab99847a1ac8e54dba48b01d3116e", "sourceModifiedAt": "2024-10-15T20:34:03.327Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.0.*（8.0.29 未満）、8.1.*（8.1.20 未満）、8.2.*（8.2.7 未満）で SOAP HTTP Digest 認証を使用すると、乱数生成関数の失敗チェックが行われず、使用される乱数のビット数が本来より狭くなります。乱数生成が失敗した場合、クライアント側の未初期化メモリ 31 ビットがサーバーに送信され情報が漏洩し、さらに悪意あるサーバーがクライアントの nonce を推測しやすくなります。", "risk": "情報漏洩によりクライアントのスタックから 31 ビットの未初期化メモリがサーバーに送られ、悪意あるサーバーがクライアントの nonce を推測しやすくなる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "SOAP の HTTP Digest 認証を使用し、乱数生成関数が失敗する可能性がある環境で、クライアントがサーバー（悪意ある可能性あり）と通信する場合。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw" ], "evidenceIds": [ "E1", "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.0系のうち、8.0.29未満。影響ありとして記載：8.1系のうち、8.1.20未満。影響ありとして記載：8.2系のうち、8.2.7未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP 8.0.29、8.1.20、8.2.7 で提供されるパッチを適用すると、nonce のサイズが拡大され、php_random_bytes_throw の戻り値がチェックされるようになり、問題が修正されます。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw" ], "evidenceIds": [ "E5" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-3247", "https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-3247", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "sourceField": "/containers/cna/title", "excerpt": "Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-76gg-c692-v2mw", "sourceField": "/description", "excerpt": "**This report was co-authored by @timwolla**\n\n### Summary\r\n\r\nThe random byte generation function used in the SOAP HTTP Digest authentication code is not checked for failure. This can result in a stack information leak. Furthermore, there's an insufficient number of random bytes used.\n\n### Details\r\n\r\nContext: https://github.com/php/php-src/blob/af809ef028e1e3ed59284e2506cab0f275b55d8e/ext/soap/php_http.c#L664-L671\r\n\r\nIf `php_random_bytes_throw` fails, the nonce will be uninitialized, but\r\nstill sent to the server. The client nonce is intended to protect\r\nagainst a malicious server. See section 5.10 and 5.12 of [RFC 7616](https://www.rfc-editor.org/rfc/rfc7616),\r\nand bullet point 2 below.\r\n\r\nTim pointed out that even though it's the MD5 of the nonce that gets sent,\r\nenumerating 31 bits is trivial. So we have still a stack information leak\r\nof 31 bits.\r\n\r\nFurthermore, Tim found the following issues:\r\n* The small size of cnonce might cause the server to erroneously reject\r\n a request due to a repeated (cnonce, nc) pair. As per the birthday\r\n problem 31 bits of randomness will return a duplication with 50%\r\n chance after less than 55000 requests and nc always starts counting at 1.\r\n* The cnonce is intended to protect the client and password against a\r\n malicious server that returns a constant server nonce where the server\r\n precomputed a rainbow table between passwords and correct client response.\r\n As storage is fairly cheap, a server could precompute the client responses\r\n for (a subset of) client nonces and still have a chance of reversing the\r\n client response with the same probability as the cnonce duplication.\r\n\r\n Precomputing the rainbow table for all 2^31 cnonces increases the rainbow\r\n table size by factor 2 billion, which is infeasible. But precomputing it\r\n for 2^14 cnonces only increases the table size by factor 16k and the server\r\n would still have a 10% chance of successfully reversing a password with a\r\n single client request.\n\n### Impact\r\n\r\nThe weak randomness affects applications that use SOAP with HTTP Digest authentication against a possibly malicious server over HTTP. The stack information leak applies to both HTTP and HTTPS, but is only a few bytes.\n\n### Proposed patch\r\n\r\nThis patch fixes the issues by increasing the nonce size, and checking\r\nthe return value of php_random_bytes_throw(). In the process we also get\r\nrid of the MD5 hashing of the nonce.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3247.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"PHP\",\"vendor\":\"PHP Group\",\"versions\":[{\"lessThan\":\"8.0.29\",\"status\":\"affected\",\"version\":\"8.0.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.1.20\",\"status\":\"affected\",\"version\":\"8.1.*\",\"versionType\":\"semver\"},{\"lessThan\":\"8.2.7\",\"status\":\"affected\",\"version\":\"8.2.*\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw", "sourceField": "/fixed", "excerpt": "[\"8.0.29\",\"8.1.20\",\"8.2.7\"]", "language": null } ], "supportRequest": "件名：CVE-2023-3247（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・SOAP の HTTP Digest 認証を使用し、乱数生成関数が失敗する可能性がある環境で、クライアントがサーバー（悪意ある可能性あり）と通信する場合。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.0系のうち、8.0.29未満。影響ありとして記載：8.1系のうち、8.1.20未満。影響ありとして記載：8.2系のうち、8.2.7未満。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-3247", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:38:13.662Z", "lastSuccess": "2026-10-25T05:38:13.662Z", "sourceCheckedAt": "2026-10-25T05:38:13.662Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-3079", "aliases": [], "title": "Chrome：脆弱性情報", "summary": "Google Chrome の V8 エンジンに型混乱があり、リモートの攻撃者が細工した HTML ページを使ってヒープ破壊を引き起こす可能性があります。", "risk": "ヒープ破壊が発生する可能性があります。", "product": "Chrome", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Chrome", "cvssVector": null, "affected": [ { "product": "Chrome", "range": ">= 114.0.5735.110 / < 114.0.5735.110" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用する。", "「CVE-2023-3079」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-3079", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html", "label": "CISAが示す関連情報" }, { "url": "https://crbug.com/1450481", "label": "CVE掲載の参考情報" }, { "url": "https://www.couchbase.com/alerts/", "label": "CVE掲載の参考情報" }, { "url": "https://www.debian.org/security/2023/dsa-5420", "label": "CVE掲載の参考情報" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/", "label": "CVE掲載の参考情報" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/", "label": "CVE掲載の参考情報" }, { "url": "https://security.gentoo.org/glsa/202311-11", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html", "label": "CVE掲載の参考情報" }, { "url": "https://security.gentoo.org/glsa/202401-34", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3079", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-06-05T21:40:06.622Z", "modifiedAt": "2025-10-21T23:05:46.769Z", "fetchedAt": "2026-10-24T09:51:24.642Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Chrome", "versions": [ { "version": "114.0.5735.110", "status": "affected", "lessThan": "114.0.5735.110", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-3079", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json", "fetchedAt": "2026-10-24T09:51:24.642Z", "publishedAt": "2023-06-05T21:40:06.622Z", "modifiedAt": "2025-10-21T23:05:46.769Z", "state": "published", "provider": "Chrome", "title": "", "descriptions": [ { "lang": "en", "value": "Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Google", "product": "Chrome", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "114.0.5735.110", "lessThan": "114.0.5735.110", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Type Confusion", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://crbug.com/1450481", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.couchbase.com/alerts/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.debian.org/security/2023/dsa-5420", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://security.gentoo.org/glsa/202311-11", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "https://security.gentoo.org/glsa/202401-34", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-3079", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"114.0.5735.110\",\"status\":\"affected\",\"lessThan\":\"114.0.5735.110\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Type Confusion\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-3079:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "sourcePath": "retained:/originalText", "text": "Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-3079:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "modifiedAt": "2023-06-07T00:00:00.000Z", "fetchedAt": "2026-10-24T09:17:49.865Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:46.769Z", "fetchedAt": "2026-10-24T09:51:24.642Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-07T00:00:00.000Z", "fetchedAt": "2026-10-24T09:17:49.865Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "Chromeに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T09:51:24.642Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "5a51fb62948f97b9092420b27d94cf4a3aca047cb28500ecc299f0ae0ae5f928", "sourceModifiedAt": "2025-10-21T23:05:46.769Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Google Chrome の V8 エンジンに型混乱があり、リモートの攻撃者が細工した HTML ページを使ってヒープ破壊を引き起こす可能性があります。", "risk": "ヒープ破壊が発生する可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Google Chrome 114.0.5735.110 未満、または Chromium を利用するブラウザーで、攻撃者が細工した HTML ページを表示させた場合に、V8 の型混乱によりヒープ破壊が発生する可能性があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079" ], "evidenceIds": [ "E1", "E2", "E3" ] }, { "text": "公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも114.0.5735.110で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Chrome」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-3079", "https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html", "https://crbug.com/1450481", "https://www.couchbase.com/alerts/", "https://www.debian.org/security/2023/dsa-5420", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/", "https://security.gentoo.org/glsa/202311-11", "http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html", "http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html", "https://security.gentoo.org/glsa/202401-34", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "https://nvd.nist.gov/vuln/detail/CVE-2023-3079" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2023-3079」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-3079", "https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html", "https://crbug.com/1450481", "https://www.couchbase.com/alerts/", "https://www.debian.org/security/2023/dsa-5420", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/", "https://security.gentoo.org/glsa/202311-11", "http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html", "http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html", "https://security.gentoo.org/glsa/202401-34", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "https://nvd.nist.gov/vuln/detail/CVE-2023-3079" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-3079", "https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html", "https://crbug.com/1450481", "https://www.couchbase.com/alerts/", "https://www.debian.org/security/2023/dsa-5420", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/", "https://security.gentoo.org/glsa/202311-11", "http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html", "http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html", "https://security.gentoo.org/glsa/202401-34", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "https://nvd.nist.gov/vuln/detail/CVE-2023-3079" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-3079", "https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html", "https://crbug.com/1450481", "https://www.couchbase.com/alerts/", "https://www.debian.org/security/2023/dsa-5420", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/", "https://security.gentoo.org/glsa/202311-11", "http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html", "http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html", "https://security.gentoo.org/glsa/202401-34", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "https://nvd.nist.gov/vuln/detail/CVE-2023-3079" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-3079", "https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html", "https://crbug.com/1450481", "https://www.couchbase.com/alerts/", "https://www.debian.org/security/2023/dsa-5420", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/", "https://security.gentoo.org/glsa/202311-11", "http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html", "http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html", "https://security.gentoo.org/glsa/202401-34", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "https://nvd.nist.gov/vuln/detail/CVE-2023-3079" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-3079", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html", "label": "CISAが示す関連情報" }, { "url": "https://crbug.com/1450481", "label": "CVE掲載の参考情報" }, { "url": "https://www.couchbase.com/alerts/", "label": "CVE掲載の参考情報" }, { "url": "https://www.debian.org/security/2023/dsa-5420", "label": "CVE掲載の参考情報" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/", "label": "CVE掲載の参考情報" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/", "label": "CVE掲載の参考情報" }, { "url": "https://security.gentoo.org/glsa/202311-11", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html", "label": "CVE掲載の参考情報" }, { "url": "https://security.gentoo.org/glsa/202401-34", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3079", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "sourceField": "retained:/originalText", "excerpt": "Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/3xxx/CVE-2023-3079.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"114.0.5735.110\",\"status\":\"affected\",\"lessThan\":\"114.0.5735.110\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-3079", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-3079\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-3079（Chrome）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Google Chrome 114.0.5735.110 未満、または Chromium を利用するブラウザーで、攻撃者が細工した HTML ページを表示させた場合に、V8 の型混乱によりヒープ破壊が発生する可能性があります。\n・公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも114.0.5735.110で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-3079", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T09:51:24.642Z", "lastSuccess": "2026-10-24T09:51:24.642Z", "sourceCheckedAt": "2026-10-24T09:51:24.642Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-33009", "aliases": [], "title": "ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) firmware / USG20(W)-VPN firmware / VPN series firmware / ZyWALL/USG series firmware：コード実行", "summary": "Zyxel の ATP、USG FLEX、USG FLEX 50(W)、USG20(W)-VPN、VPN、ZyWALL/USG 系列のファームウェア（バージョン 4.60 から 5.36 Patch 1、ZyWALL/USG は 4.60 から 4.73 Patch 1）にある通知機能にバッファオーバーフローの脆弱性があり、認証されていない攻撃者がこの脆弱性を利用して、対象デバイスでサービス停止（DoS）やリモートコード実行を引き起こす可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、デバイスがサービス停止状態になったり、攻撃者のコードが実行されたりする恐れがあります。", "product": "ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) firmware / USG20(W)-VPN firmware / VPN series firmware / ZyWALL/USG series firmware", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Zyxel", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "ATP series firmware", "range": "4.60 through 5.36 Patch 1" }, { "product": "USG FLEX series firmware", "range": "4.60 through 5.36 Patch 1" }, { "product": "USG FLEX 50(W) firmware", "range": "4.60 through 5.36 Patch 1" }, { "product": "USG20(W)-VPN firmware", "range": "4.60 through 5.36 Patch 1" }, { "product": "VPN series firmware", "range": "4.60 through 5.36 Patch 1" }, { "product": "ZyWALL/USG series firmware", "range": "4.60 through 4.73 Patch 1" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってファームウェアを最新のアップデートに適用してください。", "「CVE-2023-33009」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-33009", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33009", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-05-24T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:47.636Z", "fetchedAt": "2026-10-25T05:38:15.035Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "ATP series firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "4.60 through 5.36 Patch 1" } ] }, { "defaultStatus": "unaffected", "product": "USG FLEX series firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "4.60 through 5.36 Patch 1" } ] }, { "defaultStatus": "unaffected", "product": "USG FLEX 50(W) firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "4.60 through 5.36 Patch 1" } ] }, { "defaultStatus": "unaffected", "product": "USG20(W)-VPN firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "4.60 through 5.36 Patch 1" } ] }, { "defaultStatus": "unaffected", "product": "VPN series firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "4.60 through 5.36 Patch 1" } ] }, { "defaultStatus": "unaffected", "product": "ZyWALL/USG series firmware", "vendor": "Zyxel", "versions": [ { "status": "affected", "version": "4.60 through 4.73 Patch 1" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-33009", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "fetchedAt": "2026-10-25T05:38:15.035Z", "publishedAt": "2023-05-24T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:47.636Z", "state": "published", "provider": "Zyxel", "title": "", "descriptions": [ { "lang": "en", "value": "A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Zyxel", "product": "ATP series firmware", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "4.60 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG FLEX series firmware", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "4.60 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG FLEX 50(W) firmware", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "4.60 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG20(W)-VPN firmware", "sourcePath": "/containers/cna/affected/3", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "4.60 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "VPN series firmware", "sourcePath": "/containers/cna/affected/4", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "4.60 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "ZyWALL/USG series firmware", "sourcePath": "/containers/cna/affected/5", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "4.60 through 4.73 Patch 1", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-120", "lang": "en", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Zyxel", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33009", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"ATP series firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.60 through 5.36 Patch 1\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"USG FLEX series firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.60 through 5.36 Patch 1\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"USG FLEX 50(W) firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.60 through 5.36 Patch 1\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"USG20(W)-VPN firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.60 through 5.36 Patch 1\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"VPN series firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.60 through 5.36 Patch 1\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"ZyWALL/USG series firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.60 through 4.73 Patch 1\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-120\",\"description\":\"CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-33009:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "sourcePath": "retained:/originalText", "text": "Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-33009:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "modifiedAt": "2023-06-05T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:47.636Z", "fetchedAt": "2026-10-25T05:38:15.035Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-05T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) firmware / USG20(W)-VPN firmware / VPN series firmware / ZyWALL/USG series firmwareにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:38:15.035Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b5cb115b9a0741424e84061d36e5cce6259463b2bc465456155e4d36db36bf7f", "sourceModifiedAt": "2025-10-21T23:05:47.636Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zyxel の ATP、USG FLEX、USG FLEX 50(W)、USG20(W)-VPN、VPN、ZyWALL/USG 系列のファームウェア（バージョン 4.60 から 5.36 Patch 1、ZyWALL/USG は 4.60 から 4.73 Patch 1）にある通知機能にバッファオーバーフローの脆弱性があり、認証されていない攻撃者がこの脆弱性を利用して、対象デバイスでサービス停止（DoS）やリモートコード実行を引き起こす可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、デバイスがサービス停止状態になったり、攻撃者のコードが実行されたりする恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されていない攻撃者が通知機能を呼び出せる状態であれば、本脆弱性を悪用できる可能性があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json" ], "evidenceIds": [ "E1" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json" ], "evidenceIds": [ "E2" ] }, { "text": "「ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) firmware / USG20(W)-VPN firmware / VPN series firmware / ZyWALL/USG series firmware」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-33009", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "https://nvd.nist.gov/vuln/detail/CVE-2023-33009" ] } ], "actions": [ { "text": "ベンダーの指示に従ってファームウェアを最新のアップデートに適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009" ], "evidenceIds": [ "E3" ] }, { "text": "「CVE-2023-33009」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-33009", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "https://nvd.nist.gov/vuln/detail/CVE-2023-33009" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-33009", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "https://nvd.nist.gov/vuln/detail/CVE-2023-33009" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-33009", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "https://nvd.nist.gov/vuln/detail/CVE-2023-33009" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-33009", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "https://nvd.nist.gov/vuln/detail/CVE-2023-33009" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-33009", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33009", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33009.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"ATP series firmware\",\"vendor\":\"Zyxel\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.60 through 5.36 Patch 1\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33009", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-33009\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-33009（ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) firmware / USG20(W)-VPN firmware / VPN series firmware / ZyWALL/USG series firmware）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者が通知機能を呼び出せる状態であれば、本脆弱性を悪用できる可能性があります。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-33009", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:38:15.035Z", "lastSuccess": "2026-10-25T05:38:15.035Z", "sourceCheckedAt": "2026-10-25T05:38:15.035Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" }, { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-33010", "aliases": [], "title": "ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) firmware / USG20(W)-VPN firmware / VPN series firmware / ZyWALL/USG series firmware：コード実行", "summary": "Zyxel の ATP、USG FLEX、USG FLEX 50(W)、USG20(W)-VPN、VPN、ZyWALL/USG 系列のファームウェアにおいて、ID 処理機能にバッファオーバーフローが存在し、認証されていない攻撃者がデバイスに対してサービス停止（DoS）やリモートコード実行を引き起こす可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、対象デバイスが停止したり、攻撃者の任意のコードが実行される恐れがあります。", "product": "ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) firmware / USG20(W)-VPN firmware / VPN series firmware / ZyWALL/USG series firmware", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Zyxel", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "ATP series firmware", "range": "4.32 through 5.36 Patch 1" }, { "product": "USG FLEX series firmware", "range": "4.50 through 5.36 Patch 1" }, { "product": "USG FLEX 50(W) firmware", "range": "4.25 through 5.36 Patch 1" }, { "product": "USG20(W)-VPN firmware", "range": "4.25 through 5.36 Patch 1" }, { "product": "VPN series firmware", "range": "4.30 through 5.36 Patch 1" }, { "product": "ZyWALL/USG series firmware", "range": "4.25 through 4.73 Patch 1" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用してください。", "「CVE-2023-33010」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-33010", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33010", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-05-24T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:47.497Z", "fetchedAt": "2026-10-25T05:38:24.223Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Zyxel", "product": "ATP series firmware", "versions": [ { "version": "4.32 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG FLEX series firmware", "versions": [ { "version": "4.50 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG FLEX 50(W) firmware", "versions": [ { "version": "4.25 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG20(W)-VPN firmware", "versions": [ { "version": "4.25 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "VPN series firmware", "versions": [ { "version": "4.30 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "ZyWALL/USG series firmware", "versions": [ { "version": "4.25 through 4.73 Patch 1", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-33010", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "fetchedAt": "2026-10-25T05:38:24.223Z", "publishedAt": "2023-05-24T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:47.497Z", "state": "published", "provider": "Zyxel", "title": "", "descriptions": [ { "lang": "en", "value": "A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Zyxel", "product": "ATP series firmware", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "4.32 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG FLEX series firmware", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "4.50 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG FLEX 50(W) firmware", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "4.25 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG20(W)-VPN firmware", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "4.25 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "VPN series firmware", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "4.30 through 5.36 Patch 1", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "ZyWALL/USG series firmware", "sourcePath": "/containers/cna/affected/5", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "4.25 through 4.73 Patch 1", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-120", "lang": "en", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Zyxel", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33010", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Zyxel\",\"product\":\"ATP series firmware\",\"versions\":[{\"version\":\"4.32 through 5.36 Patch 1\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Zyxel\",\"product\":\"USG FLEX series firmware\",\"versions\":[{\"version\":\"4.50 through 5.36 Patch 1\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Zyxel\",\"product\":\"USG FLEX 50(W) firmware\",\"versions\":[{\"version\":\"4.25 through 5.36 Patch 1\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Zyxel\",\"product\":\"USG20(W)-VPN firmware\",\"versions\":[{\"version\":\"4.25 through 5.36 Patch 1\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Zyxel\",\"product\":\"VPN series firmware\",\"versions\":[{\"version\":\"4.30 through 5.36 Patch 1\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Zyxel\",\"product\":\"ZyWALL/USG series firmware\",\"versions\":[{\"version\":\"4.25 through 4.73 Patch 1\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"CWE\",\"lang\":\"en\",\"description\":\"CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\",\"cweId\":\"CWE-120\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-33010:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "sourcePath": "retained:/originalText", "text": "Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-33010:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "modifiedAt": "2023-06-05T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:47.497Z", "fetchedAt": "2026-10-25T05:38:24.223Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-05T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) firmware / USG20(W)-VPN firmware / VPN series firmware / ZyWALL/USG series firmwareにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:38:24.223Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "bf48f54e36b94267835861eafb6cf6f5a0002222f31862e5d69e29c8ea4e6a73", "sourceModifiedAt": "2025-10-21T23:05:47.497Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zyxel の ATP、USG FLEX、USG FLEX 50(W)、USG20(W)-VPN、VPN、ZyWALL/USG 系列のファームウェアにおいて、ID 処理機能にバッファオーバーフローが存在し、認証されていない攻撃者がデバイスに対してサービス停止（DoS）やリモートコード実行を引き起こす可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、対象デバイスが停止したり、攻撃者の任意のコードが実行される恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されていない攻撃者が、ID 処理機能に細工した入力を送信できることが前提条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json" ], "evidenceIds": [ "E3" ] }, { "text": "「ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) firmware / USG20(W)-VPN firmware / VPN series firmware / ZyWALL/USG series firmware」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-33010", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "https://nvd.nist.gov/vuln/detail/CVE-2023-33010" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010" ], "evidenceIds": [ "E4", "E5" ] }, { "text": "「CVE-2023-33010」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-33010", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "https://nvd.nist.gov/vuln/detail/CVE-2023-33010" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-33010", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "https://nvd.nist.gov/vuln/detail/CVE-2023-33010" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-33010", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "https://nvd.nist.gov/vuln/detail/CVE-2023-33010" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-33010", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "https://nvd.nist.gov/vuln/detail/CVE-2023-33010" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-33010", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33010", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "sourceField": "retained:/originalText", "excerpt": "Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/33xxx/CVE-2023-33010.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"ATP series firmware\",\"versions\":[{\"version\":\"4.32 through 5.36 Patch 1\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "sourceField": "/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33010", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-33010\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-33010（ATP series firmware / USG FLEX series firmware / USG FLEX 50(W) firmware / USG20(W)-VPN firmware / VPN series firmware / ZyWALL/USG series firmware）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者が、ID 処理機能に細工した入力を送信できることが前提条件です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-33010", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:38:24.223Z", "lastSuccess": "2026-10-25T05:38:24.223Z", "sourceCheckedAt": "2026-10-25T05:38:24.223Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" }, { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-34362", "aliases": [], "title": "n/a：データベースへの不正操作", "summary": "Progress MOVEit Transfer の 2021.0.6 (13.0.6) 未満、2021.1.4 (13.1.4) 未満、2022.0.4 (14.0.4) 未満、2022.1.5 (14.1.5) 未満、2023.0.1 (15.0.1) 未満のバージョンに SQL インジェクション脆弱性があり、認証されていない攻撃者が HTTP または HTTPS 経由でデータベースに不正にアクセスできる可能性があります。使用しているデータベースエンジンが MySQL、Microsoft SQL Server、または Azure SQL のいずれかである場合、攻撃者はデータベースの構造や内容を推測したり、SQL 文を実行してデータベース要素を変更・削除したりできることがあります。", "risk": "攻撃者がデータベースに不正にアクセスできるため、データベースの構造や内容が漏洩したり、データが改ざん・削除されたりする危険があります。", "product": "Progress MOVEit Transfer", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用してください。", "「CVE-2023-34362」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-34362", "label": "CVE公式レコード" }, { "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "label": "CISAが示す関連情報" }, { "url": "http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34362", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-06-02T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:46.909Z", "fetchedAt": "2026-10-25T08:52:08.272Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-34362", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json", "fetchedAt": "2026-10-25T08:52:08.272Z", "publishedAt": "2023-06-02T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:46.909Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34362", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"text\",\"lang\":\"en\",\"description\":\"n/a\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-34362:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "sourcePath": "retained:/originalText", "text": "Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-34362:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "modifiedAt": "2023-06-02T00:00:00.000Z", "fetchedAt": "2026-10-25T08:17:49.387Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:46.909Z", "fetchedAt": "2026-10-25T08:52:08.272Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-06-02T00:00:00.000Z", "fetchedAt": "2026-10-25T08:17:49.387Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "n/aにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T08:52:08.272Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "1acfb0811f004f065397ca8517158e1de370468d4ffbf18175d617aa43d1d111", "sourceModifiedAt": "2025-10-21T23:05:46.909Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Progress MOVEit Transfer の 2021.0.6 (13.0.6) 未満、2021.1.4 (13.1.4) 未満、2022.0.4 (14.0.4) 未満、2022.1.5 (14.1.5) 未満、2023.0.1 (15.0.1) 未満のバージョンに SQL インジェクション脆弱性があり、認証されていない攻撃者が HTTP または HTTPS 経由でデータベースに不正にアクセスできる可能性があります。使用しているデータベースエンジンが MySQL、Microsoft SQL Server、または Azure SQL のいずれかである場合、攻撃者はデータベースの構造や内容を推測したり、SQL 文を実行してデータベース要素を変更・削除したりできることがあります。", "risk": "攻撃者がデータベースに不正にアクセスできるため、データベースの構造や内容が漏洩したり、データが改ざん・削除されたりする危険があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されていない攻撃者が HTTP または HTTPS 経由で MOVEit Transfer のウェブアプリケーションにアクセスできることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象となるデータベースエンジンは MySQL、Microsoft SQL Server、または Azure SQL のいずれかである必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Progress MOVEit Transfer」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-34362", "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "https://nvd.nist.gov/vuln/detail/CVE-2023-34362" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362" ], "evidenceIds": [ "E3" ] }, { "text": "「CVE-2023-34362」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-34362", "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "https://nvd.nist.gov/vuln/detail/CVE-2023-34362" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-34362", "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "https://nvd.nist.gov/vuln/detail/CVE-2023-34362" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-34362", "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "https://nvd.nist.gov/vuln/detail/CVE-2023-34362" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-34362", "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html", "http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "https://nvd.nist.gov/vuln/detail/CVE-2023-34362" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-34362", "label": "CVE公式レコード" }, { "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "label": "CISAが示す関連情報" }, { "url": "http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34362", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/34xxx/CVE-2023-34362.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-34362", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-34362\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-34362（Progress MOVEit Transfer）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者が HTTP または HTTPS 経由で MOVEit Transfer のウェブアプリケーションにアクセスできることが前提です。\n・対象となるデータベースエンジンは MySQL、Microsoft SQL Server、または Azure SQL のいずれかである必要があります。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-34362", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T08:52:08.272Z", "lastSuccess": "2026-10-25T08:52:08.272Z", "sourceCheckedAt": "2026-10-25T08:52:08.272Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-28771", "aliases": [], "title": "ZyWALL/USG series firmware / VPN series firmware / USG FLEX series firmware / ATP series firmware：脆弱性情報", "summary": "Zyxel の ZyWALL/USG 系列、VPN 系列、USG FLEX 系列、ATP 系列のファームウェア（バージョン 4.60 から 4.73、または 5.35 まで）において、エラーメッセージの処理が不適切であり、認証されていない攻撃者が細工したパケットを送信すると、リモートで OS コマンドを実行させられる可能性があります。", "risk": "攻撃者がリモートで OS コマンドを実行できるため、デバイスが不正に制御される危険があります。", "product": "ZyWALL/USG series firmware / VPN series firmware / USG FLEX series firmware / ATP series firmware", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Zyxel", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "ZyWALL/USG series firmware", "range": "4.60 through 4.73" }, { "product": "VPN series firmware", "range": "4.60 through 5.35" }, { "product": "USG FLEX series firmware", "range": "4.60 through 5.35" }, { "product": "ATP series firmware", "range": "4.60 through 5.35" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用する。", "「CVE-2023-28771」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-28771", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls", "label": "CISAが示す関連情報" }, { "url": "http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28771", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-04-25T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:48.400Z", "fetchedAt": "2026-10-25T05:38:28.456Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Zyxel", "product": "ZyWALL/USG series firmware", "versions": [ { "version": "4.60 through 4.73", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "VPN series firmware", "versions": [ { "version": "4.60 through 5.35", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG FLEX series firmware", "versions": [ { "version": "4.60 through 5.35", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "ATP series firmware", "versions": [ { "version": "4.60 through 5.35", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-28771", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "fetchedAt": "2026-10-25T05:38:28.456Z", "publishedAt": "2023-04-25T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:48.400Z", "state": "published", "provider": "Zyxel", "title": "", "descriptions": [ { "lang": "en", "value": "Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Zyxel", "product": "ZyWALL/USG series firmware", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "4.60 through 4.73", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "VPN series firmware", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "4.60 through 5.35", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "USG FLEX series firmware", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "4.60 through 5.35", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "ATP series firmware", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "4.60 through 5.35", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Zyxel", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Zyxel\",\"product\":\"ZyWALL/USG series firmware\",\"versions\":[{\"version\":\"4.60 through 4.73\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Zyxel\",\"product\":\"VPN series firmware\",\"versions\":[{\"version\":\"4.60 through 5.35\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Zyxel\",\"product\":\"USG FLEX series firmware\",\"versions\":[{\"version\":\"4.60 through 5.35\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Zyxel\",\"product\":\"ATP series firmware\",\"versions\":[{\"version\":\"4.60 through 5.35\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"CWE\",\"lang\":\"en\",\"description\":\"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"cweId\":\"CWE-78\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-28771:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "sourcePath": "retained:/originalText", "text": "Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-28771:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "modifiedAt": "2023-05-31T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:48.400Z", "fetchedAt": "2026-10-25T05:38:28.456Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-05-31T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "ZyWALL/USG series firmware / VPN series firmware / USG FLEX series firmware / ATP series firmwareに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:38:28.456Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "afa8973e9efeef75700e04402c9d10e4a49e858676d5c52712aea9c8b1b6fb3c", "sourceModifiedAt": "2025-10-21T23:05:48.400Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zyxel の ZyWALL/USG 系列、VPN 系列、USG FLEX 系列、ATP 系列のファームウェア（バージョン 4.60 から 4.73、または 5.35 まで）において、エラーメッセージの処理が不適切であり、認証されていない攻撃者が細工したパケットを送信すると、リモートで OS コマンドを実行させられる可能性があります。", "risk": "攻撃者がリモートで OS コマンドを実行できるため、デバイスが不正に制御される危険があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "認証されていない攻撃者が細工したパケットを送信できることが前提条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Zyxel / ZyWALL/USG series firmware。影響ありとして記載：4.60 through 4.73。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Zyxel / VPN series firmware。影響ありとして記載：4.60 through 5.35。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Zyxel / USG FLEX series firmware。影響ありとして記載：4.60 through 5.35。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Zyxel / ATP series firmware。影響ありとして記載：4.60 through 5.35。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json" ], "evidenceIds": [ "E6" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771" ], "evidenceIds": [ "E9" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json" ], "evidenceIds": [ "E3" ] }, { "text": "「ZyWALL/USG series firmware / VPN series firmware / USG FLEX series firmware / ATP series firmware」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-28771", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls", "http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "https://nvd.nist.gov/vuln/detail/CVE-2023-28771" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用する。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771" ], "evidenceIds": [ "E7", "E8" ] }, { "text": "「CVE-2023-28771」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-28771", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls", "http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "https://nvd.nist.gov/vuln/detail/CVE-2023-28771" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-28771", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls", "http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "https://nvd.nist.gov/vuln/detail/CVE-2023-28771" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-28771", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls", "http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "https://nvd.nist.gov/vuln/detail/CVE-2023-28771" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-28771", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls", "http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "https://nvd.nist.gov/vuln/detail/CVE-2023-28771" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-28771", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls", "label": "CISAが示す関連情報" }, { "url": "http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28771", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "sourceField": "retained:/originalText", "excerpt": "Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.", "language": "en", "representation": "retained_feed_field" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"ZyWALL/USG series firmware\",\"versions\":[{\"version\":\"4.60 through 4.73\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"VPN series firmware\",\"versions\":[{\"version\":\"4.60 through 5.35\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"USG FLEX series firmware\",\"versions\":[{\"version\":\"4.60 through 5.35\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28771.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"ATP series firmware\",\"versions\":[{\"version\":\"4.60 through 5.35\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "sourceField": "/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null }, { "id": "E9", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28771", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-28771\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-28771（ZyWALL/USG series firmware / VPN series firmware / USG FLEX series firmware / ATP series firmware）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者が細工したパケットを送信できることが前提条件です。\n・公式の対象表：Zyxel / ZyWALL/USG series firmware。影響ありとして記載：4.60 through 4.73。\n・公式の対象表：Zyxel / VPN series firmware。影響ありとして記載：4.60 through 5.35。\n・公式の対象表：Zyxel / USG FLEX series firmware。影響ありとして記載：4.60 through 5.35。\n・公式の対象表：Zyxel / ATP series firmware。影響ありとして記載：4.60 through 5.35。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-28771", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:38:28.456Z", "lastSuccess": "2026-10-25T05:38:28.456Z", "sourceCheckedAt": "2026-10-25T05:38:28.456Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-2288", "aliases": [], "title": "Otter：脆弱性情報", "summary": "Otter WordPress プラグインのバージョン 2.2.6 未満では、ユーザーが指定できるファイルパスがサニタイズされずにファイル操作に使用されるため、PHP 8.0 未満の環境で phar:// ストリームラッパーを介した PHAR デシリアライズ脆弱性が発生します。", "risk": "PHAR デシリアライズ脆弱性が存在します。", "product": "Otter", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "nvd@nist.gov", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Otter", "range": "< 2.2.6" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json", "label": "CVE：WPScan" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-2288", "label": "CVE公式レコード" }, { "url": "https://wpscan.com/vulnerability/93acb4ee-1053-48e1-8b69-c09dc3b2f302", "label": "af854a3a-2127-422b-91ae-364da2661108" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2288", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2023-05-30T07:49:15.477Z", "modifiedAt": "2026-10-24T13:10:00.147Z", "fetchedAt": "2026-10-24T13:22:57.839Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.", "sourceTitle": "Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Otter", "versions": [ { "status": "affected", "versionType": "custom", "version": "0", "lessThan": "2.2.6" } ], "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-2288", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json", "fetchedAt": "2026-10-24T13:22:57.839Z", "publishedAt": "2023-05-30T07:49:15.477Z", "modifiedAt": "2025-01-10T21:04:14.508Z", "state": "published", "provider": "WPScan", "title": "Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization", "descriptions": [ { "lang": "en", "value": "The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Unknown", "product": "Otter", "sourcePath": "/containers/cna/affected/0", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "2.2.6", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://wpscan.com/vulnerability/93acb4ee-1053-48e1-8b69-c09dc3b2f302", "label": "CVE", "tags": [ "exploit", "vdb-entry", "technical-description", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Unknown\",\"product\":\"Otter\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"custom\",\"version\":\"0\",\"lessThan\":\"2.2.6\"}],\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://wordpress.org/plugins\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-502 Deserialization of Untrusted Data\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-01-10T21:04:14.508Z", "fetchedAt": "2026-10-24T13:22:57.839Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-24T13:10:00.147Z", "fetchedAt": "2026-10-24T13:17:49.742Z", "state": "published" } ], "configurationDetails": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themeisle:otter:*:*:*:*:*:wordpress:*:*", "versionEndExcluding": "2.2.6", "matchCriteriaId": "8EA26D1F-4E7C-4C53-9132-22838DB5F877" } ] } ] } ], "sourceSummary": "Otterに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-24T13:22:57.839Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "561a91cf36dad4cccde1be9dbf7f480b9a9f3885b63465d84df82e171e22a7df", "sourceModifiedAt": "2026-10-24T13:10:00.147Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Otter WordPress プラグインのバージョン 2.2.6 未満では、ユーザーが指定できるファイルパスがサニタイズされずにファイル操作に使用されるため、PHP 8.0 未満の環境で phar:// ストリームラッパーを介した PHAR デシリアライズ脆弱性が発生します。", "risk": "PHAR デシリアライズ脆弱性が存在します。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は Otter WordPress プラグインのバージョンが 2.2.6 未満であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP のバージョンが 8.0 未満であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "phar:// ストリームラッパーが使用可能な環境であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "ファイル操作に使用されるパスがユーザーによって制御可能であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Otter。影響ありとして記載：2.2.6未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Otter」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2023-2288", "https://wpscan.com/vulnerability/93acb4ee-1053-48e1-8b69-c09dc3b2f302", "https://nvd.nist.gov/vuln/detail/CVE-2023-2288" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json", "label": "CVE：WPScan" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-2288", "label": "CVE公式レコード" }, { "url": "https://wpscan.com/vulnerability/93acb4ee-1053-48e1-8b69-c09dc3b2f302", "label": "af854a3a-2127-422b-91ae-364da2661108" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2288", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json", "sourceField": "/containers/cna/title", "excerpt": "Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2288.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Unknown\",\"product\":\"Otter\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"custom\",\"version\":\"0\",\"lessThan\":\"2.2.6\"}],\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://wordpress.org/plugins\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2023-2288（Otter）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Otter WordPress プラグインのバージョンが 2.2.6 未満であること。\n・PHP のバージョンが 8.0 未満であること。\n・phar:// ストリームラッパーが使用可能な環境であること。\n・ファイル操作に使用されるパスがユーザーによって制御可能であること。\n・公式の対象表：Otter。影響ありとして記載：2.2.6未満の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-2288", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-24T13:22:57.839Z", "lastSuccess": "2026-10-24T13:22:57.839Z", "sourceCheckedAt": "2026-10-24T13:22:57.839Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-2868", "aliases": [], "title": "Barracuda Email Security Gateway：脆弱性情報", "summary": "Barracuda Email Security Gateway（アプライアンス形態のみ）のバージョン5.1.3.001から9.2.0.006までに、.tar ファイル内のファイル名を十分に検証しないため、リモートからコマンドを実行させることができるリモートコマンドインジェクション脆弱性が存在します。", "risk": "攻撃者が細工した .tar ファイルを送信すると、Perl の qx 演算子を介して Email Security Gateway の権限でシステムコマンドがリモート実行されます。", "product": "Barracuda Email Security Gateway", "category": "other", "component": "package", "severity": "critical", "cvss": 9.4, "cvssVersion": "3.1", "cvssSource": "Google", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "affected": [ { "product": "Barracuda Email Security Gateway", "range": ">= 5.1.3.001 / < 9.2.0.006" } ], "fixed": [], "steps": [ "ベンダーの指示に従ってアップデートを適用してください。", "「CVE-2023-2868」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json", "label": "CVE：Google" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-2868", "label": "CVE公式レコード" }, { "url": "https://www.barracuda.com/company/legal/esg-vulnerability", "label": "CVE掲載の参考情報" }, { "url": "https://status.barracuda.com/incidents/34kx82j5n4q9", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2868", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-05-24T18:00:52.360Z", "modifiedAt": "2025-10-21T23:05:47.195Z", "fetchedAt": "2026-10-25T09:01:38.224Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.", "sourceTitle": "Remote Code injection in Barracuda Email Security Gateway", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Barracuda Email Security Gateway", "vendor": "Barracuda", "versions": [ { "lessThan": "9.2.0.006", "status": "affected", "version": "5.1.3.001", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-2868", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json", "fetchedAt": "2026-10-25T09:01:38.224Z", "publishedAt": "2023-05-24T18:00:52.360Z", "modifiedAt": "2025-10-21T23:05:47.195Z", "state": "published", "provider": "Google", "title": "Remote Code injection in Barracuda Email Security Gateway", "descriptions": [ { "lang": "en", "value": "A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Barracuda", "product": "Barracuda Email Security Gateway", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "5.1.3.001", "lessThan": "9.2.0.006", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "baseScore": 9.4, "baseSeverity": "CRITICAL", "provider": "Google", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.barracuda.com/company/legal/esg-vulnerability", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://status.barracuda.com/incidents/34kx82j5n4q9", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Barracuda Email Security Gateway\",\"vendor\":\"Barracuda\",\"versions\":[{\"lessThan\":\"9.2.0.006\",\"status\":\"affected\",\"version\":\"5.1.3.001\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-20\",\"description\":\"CWE-20 Improper Input Validation\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"LOW\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-2868:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "sourcePath": "retained:/originalText", "text": "Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-2868:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "modifiedAt": "2023-05-26T00:00:00.000Z", "fetchedAt": "2026-10-25T08:17:49.387Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:47.195Z", "fetchedAt": "2026-10-25T09:01:38.224Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-05-26T00:00:00.000Z", "fetchedAt": "2026-10-25T08:17:49.387Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "Barracuda Email Security Gatewayに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T09:01:38.224Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "bc99f29525b4965adc515ef3db0c6f46e8bc2b607809d4e4e5c12956721e6fd6", "sourceModifiedAt": "2025-10-21T23:05:47.195Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Barracuda Email Security Gateway（アプライアンス形態のみ）のバージョン5.1.3.001から9.2.0.006までに、.tar ファイル内のファイル名を十分に検証しないため、リモートからコマンドを実行させることができるリモートコマンドインジェクション脆弱性が存在します。", "risk": "攻撃者が細工した .tar ファイルを送信すると、Perl の qx 演算子を介して Email Security Gateway の権限でシステムコマンドがリモート実行されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者がユーザー提供の .tar ファイルをアップロードできる環境で、ファイル名を特定の形式に加工して送信できることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Barracuda / Barracuda Email Security Gateway。影響ありとして記載：5.1.3.001以上、9.2.0.006未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Barracuda Email Security Gateway」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-2868", "https://www.barracuda.com/company/legal/esg-vulnerability", "https://status.barracuda.com/incidents/34kx82j5n4q9", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "https://nvd.nist.gov/vuln/detail/CVE-2023-2868" ] } ], "actions": [ { "text": "ベンダーの指示に従ってアップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2023-2868」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-2868", "https://www.barracuda.com/company/legal/esg-vulnerability", "https://status.barracuda.com/incidents/34kx82j5n4q9", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "https://nvd.nist.gov/vuln/detail/CVE-2023-2868" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-2868", "https://www.barracuda.com/company/legal/esg-vulnerability", "https://status.barracuda.com/incidents/34kx82j5n4q9", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "https://nvd.nist.gov/vuln/detail/CVE-2023-2868" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-2868", "https://www.barracuda.com/company/legal/esg-vulnerability", "https://status.barracuda.com/incidents/34kx82j5n4q9", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "https://nvd.nist.gov/vuln/detail/CVE-2023-2868" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-2868", "https://www.barracuda.com/company/legal/esg-vulnerability", "https://status.barracuda.com/incidents/34kx82j5n4q9", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "https://nvd.nist.gov/vuln/detail/CVE-2023-2868" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json", "label": "CVE：Google" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-2868", "label": "CVE公式レコード" }, { "url": "https://www.barracuda.com/company/legal/esg-vulnerability", "label": "CVE掲載の参考情報" }, { "url": "https://status.barracuda.com/incidents/34kx82j5n4q9", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2868", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json", "sourceField": "/containers/cna/title", "excerpt": "Remote Code injection in Barracuda Email Security Gateway", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/2xxx/CVE-2023-2868.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Barracuda Email Security Gateway\",\"vendor\":\"Barracuda\",\"versions\":[{\"lessThan\":\"9.2.0.006\",\"status\":\"affected\",\"version\":\"5.1.3.001\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-2868", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-2868\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-2868（Barracuda Email Security Gateway）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者がユーザー提供の .tar ファイルをアップロードできる環境で、ファイル名を特定の形式に加工して送信できることが前提です。\n・公式の対象表：Barracuda / Barracuda Email Security Gateway。影響ありとして記載：5.1.3.001以上、9.2.0.006未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-2868", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T09:01:38.224Z", "lastSuccess": "2026-10-25T09:01:38.224Z", "sourceCheckedAt": "2026-10-25T09:01:38.224Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-28204", "aliases": [], "title": "macOS / Safari / watchOS / iOS and iPadOS / tvOS：情報の漏えい", "summary": "境界外読み取りが改善された入力検証により対策されました。この問題は watchOS 9.5、tvOS 16.5、macOS Ventura 13.4、iOS 15.7.6、iPadOS 15.7.6、Safari 16.5、iOS 16.5、iPadOS 16.5 で修正されています。ウェブコンテンツを処理する際に機密情報が漏洩する可能性があり、Apple はこの問題が実際に悪用されたとの報告を認識しています。", "risk": "ウェブコンテンツを処理する際に機密情報が漏洩する可能性があります。", "product": "macOS / Safari / watchOS / iOS and iPadOS / tvOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "macOS", "range": ">= unspecified / < 13.4" }, { "product": "Safari", "range": ">= unspecified / < 16.5" }, { "product": "watchOS", "range": ">= unspecified / < 9.5" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 15.7" }, { "product": "iOS and iPadOS", "range": ">= unspecified / < 16.5" }, { "product": "tvOS", "range": ">= unspecified / < 16.5" } ], "fixed": [], "steps": [ "この問題は watchOS 9.5、tvOS 16.5、macOS Ventura 13.4、iOS 15.7.6、iPadOS 15.7.6、Safari 16.5、iOS 16.5、iPadOS 16.5 で修正されています。", "ベンダーの指示に従ってアップデートを適用してください。", "「CVE-2023-28204」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-28204", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/HT213758", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213762", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213764", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213765", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213757", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213761", "label": "CVE掲載の参考情報" }, { "url": "https://security.gentoo.org/glsa/202401-04", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/HT213757", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/HT213758", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/HT213761", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/HT213762", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/HT213764", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-06-23T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:45.355Z", "fetchedAt": "2026-10-25T05:38:38.262Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "13.4", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "Safari", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "16.5", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "watchOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "9.5", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "15.7", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "16.5", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "tvOS", "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "16.5", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-28204", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "fetchedAt": "2026-10-25T05:38:38.262Z", "publishedAt": "2023-06-23T00:00:00.000Z", "modifiedAt": "2025-10-21T23:05:45.355Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.", "sourcePath": "retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "representation": "retained_feed_field" } ], "affected": [ { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "unspecified", "lessThan": "13.4", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "Safari", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "unspecified", "lessThan": "16.5", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "watchOS", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "unspecified", "lessThan": "9.5", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "unspecified", "lessThan": "15.7", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "unspecified", "lessThan": "16.5", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "tvOS", "sourcePath": "/containers/cna/affected/5", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "unspecified", "lessThan": "16.5", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/HT213758", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://support.apple.com/en-us/HT213762", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://support.apple.com/en-us/HT213764", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://support.apple.com/en-us/HT213765", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://support.apple.com/en-us/HT213757", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://support.apple.com/en-us/HT213761", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://security.gentoo.org/glsa/202401-04", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28204", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"13.4\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"9.5\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.7\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":6.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "cisa:CVE-2023-28204:retained:/originalText", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "sourcePath": "retained:/originalText", "text": "Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.", "upstreamField": "shortDescription", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" }, { "evidenceId": "cisa:CVE-2023-28204:retained:/sourceAction", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "sourcePath": "retained:/sourceAction", "text": "Apply updates per vendor instructions.", "upstreamField": "requiredAction", "truncated": false, "representation": "retained_feed_field", "sourceType": "CISA KEV" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CISAの保存済みフィードの説明・対応を、CVE本文と出典を分けて保持しています。この処理でCISAを再取得したとは扱いません。" }, "supplementarySources": [ { "sourceType": "CISA KEV retained snapshot", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "modifiedAt": "2023-05-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "retained": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2025-10-21T23:05:45.355Z", "fetchedAt": "2026-10-25T05:38:38.262Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2023-05-22T00:00:00.000Z", "fetchedAt": "2026-10-25T05:17:50.551Z", "state": "published" } ], "sourceAction": "Apply updates per vendor instructions.", "sourceSummary": "macOS / Safari / watchOS / iOS and iPadOS / tvOSに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-25T05:38:38.262Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7ca640d81dae738f1a603fec0d91dae11fb37c1f327fca936cd626de7ec3cf3b", "sourceModifiedAt": "2025-10-21T23:05:45.355Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "境界外読み取りが改善された入力検証により対策されました。この問題は watchOS 9.5、tvOS 16.5、macOS Ventura 13.4、iOS 15.7.6、iPadOS 15.7.6、Safari 16.5、iOS 16.5、iPadOS 16.5 で修正されています。ウェブコンテンツを処理する際に機密情報が漏洩する可能性があり、Apple はこの問題が実際に悪用されたとの報告を認識しています。", "risk": "ウェブコンテンツを処理する際に機密情報が漏洩する可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "公式の対象表：Apple / macOS。影響ありとして記載：13.4未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / Safari。影響ありとして記載：16.5未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / watchOS。影響ありとして記載：9.5未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.7未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：16.5未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Apple / tvOS。影響ありとして記載：16.5未満（原資料では開始版が未指定）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json" ], "evidenceIds": [ "E8" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204" ], "evidenceIds": [ "E10" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json" ], "evidenceIds": [ "E3" ] }, { "text": "「macOS / Safari / watchOS / iOS and iPadOS / tvOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-28204", "https://support.apple.com/en-us/HT213758", "https://support.apple.com/en-us/HT213762", "https://support.apple.com/en-us/HT213764", "https://support.apple.com/en-us/HT213765", "https://support.apple.com/en-us/HT213757", "https://support.apple.com/en-us/HT213761", "https://security.gentoo.org/glsa/202401-04", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "https://support.apple.com/HT213757", "https://support.apple.com/HT213758", "https://support.apple.com/HT213761", "https://support.apple.com/HT213762", "https://support.apple.com/HT213764" ] } ], "actions": [ { "text": "この問題は watchOS 9.5、tvOS 16.5、macOS Ventura 13.4、iOS 15.7.6、iPadOS 15.7.6、Safari 16.5、iOS 16.5、iPadOS 16.5 で修正されています。", "kind": "fix", "evidenceIds": [ "E1" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json" ] }, { "text": "ベンダーの指示に従ってアップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204" ], "evidenceIds": [ "E9" ] }, { "text": "「CVE-2023-28204」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-28204", "https://support.apple.com/en-us/HT213758", "https://support.apple.com/en-us/HT213762", "https://support.apple.com/en-us/HT213764", "https://support.apple.com/en-us/HT213765", "https://support.apple.com/en-us/HT213757", "https://support.apple.com/en-us/HT213761", "https://security.gentoo.org/glsa/202401-04", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "https://support.apple.com/HT213757", "https://support.apple.com/HT213758", "https://support.apple.com/HT213761", "https://support.apple.com/HT213762", "https://support.apple.com/HT213764" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-28204", "https://support.apple.com/en-us/HT213758", "https://support.apple.com/en-us/HT213762", "https://support.apple.com/en-us/HT213764", "https://support.apple.com/en-us/HT213765", "https://support.apple.com/en-us/HT213757", "https://support.apple.com/en-us/HT213761", "https://security.gentoo.org/glsa/202401-04", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "https://support.apple.com/HT213757", "https://support.apple.com/HT213758", "https://support.apple.com/HT213761", "https://support.apple.com/HT213762", "https://support.apple.com/HT213764" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-28204", "https://support.apple.com/en-us/HT213758", "https://support.apple.com/en-us/HT213762", "https://support.apple.com/en-us/HT213764", "https://support.apple.com/en-us/HT213765", "https://support.apple.com/en-us/HT213757", "https://support.apple.com/en-us/HT213761", "https://security.gentoo.org/glsa/202401-04", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "https://support.apple.com/HT213757", "https://support.apple.com/HT213758", "https://support.apple.com/HT213761", "https://support.apple.com/HT213762", "https://support.apple.com/HT213764" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-28204", "https://support.apple.com/en-us/HT213758", "https://support.apple.com/en-us/HT213762", "https://support.apple.com/en-us/HT213764", "https://support.apple.com/en-us/HT213765", "https://support.apple.com/en-us/HT213757", "https://support.apple.com/en-us/HT213761", "https://security.gentoo.org/glsa/202401-04", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "https://support.apple.com/HT213757", "https://support.apple.com/HT213758", "https://support.apple.com/HT213761", "https://support.apple.com/HT213762", "https://support.apple.com/HT213764" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-28204", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/HT213758", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213762", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213764", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213765", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213757", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/en-us/HT213761", "label": "CVE掲載の参考情報" }, { "url": "https://security.gentoo.org/glsa/202401-04", "label": "CVE掲載の参考情報" }, { "url": "https://support.apple.com/HT213757", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/HT213758", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/HT213761", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/HT213762", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/HT213764", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"description\":\"Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"13.4\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"9.5\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"15.7\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28204.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"16.5\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "sourceField": "retained:/sourceAction", "excerpt": "Apply updates per vendor instructions.", "language": null, "representation": "retained_feed_field" }, { "id": "E10", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-28204\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-28204（macOS / Safari / watchOS / iOS and iPadOS / tvOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Apple / macOS。影響ありとして記載：13.4未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / Safari。影響ありとして記載：16.5未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / watchOS。影響ありとして記載：9.5未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：15.7未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：16.5未満（原資料では開始版が未指定）。\n・公式の対象表：Apple / tvOS。影響ありとして記載：16.5未満（原資料では開始版が未指定）。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-28204", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-25T05:38:38.262Z", "lastSuccess": "2026-10-25T05:38:38.262Z", "sourceCheckedAt": "2026-10-25T05:38:38.262Z", "errorCode": null }, "glossary": [] } } ], "total": 2302, "limit": 20, "offset": 1340, "filters": { "product": "all", "type": "all", "q": "", "page": 68 }, "pagination": { "page": 68, "pageSize": 20, "totalPages": 116 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-25T08:17:49.387Z", "lastAttempt": "2026-10-25T08:17:49.387Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "error", "lastSuccess": "2026-10-25T07:17:49.121Z", "lastAttempt": "2026-10-25T08:17:49.387Z", "error": "GitHub API取得上限に到達 (2026-10-25T08:46:48.000Z以降に再取得)", "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-25T08:17:49.387Z", "lastAttempt": "2026-10-25T08:17:49.387Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-25T08:17:49.387Z", "lastAttempt": "2026-10-25T08:17:49.387Z", "error": null, "recordCount": 0, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-25T07:02:49.121Z 〜 2026-10-25T08:17:49.387Z、全製品の変更 5/5件まで確認、対象0件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-25T08:17:49.387Z", "lastAttempt": "2026-10-25T08:17:49.387Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。 PHP公式ニュース経由で候補補足（先頭20項目から2件）。GitHub全件代替ではない。CVE取得は既存候補と合わせ最大6件。", "cursor": null, "freshness": "fresh", "stale": false } ] }