NVD Vulnerability Detail

CVE-2023-3440

Summary	Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Management - Manager: from 09-00 before 12-50-07; JP1/Performance Management - Base: from 09-00 through 10-50-; JP1/Performance Management - Agent Option for Application Server: from 11-00 before 11-50-16; JP1/Performance Management - Agent Option for Enterprise Applications: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for HiRDB: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for IBM Lotus Domino: from 10-00 before 11-50-16; JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Agent Option for Platform: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Service Response: from 09-00 before 11-50-16; JP1/Performance Management - Agent Option for Transaction System: from 11-00 before 12-00-14; JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Remote Monitor for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Platform: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Virtual Machine: from 10-00 before 12-50-07; JP1/Performance Management - Agent Option for Domino: from 09-00 through 09-00-; JP1/Performance Management - Agent Option for IBM WebSphere Application Server: from 09-00 through 10-00-; JP1/Performance Management - Agent Option for IBM WebSphere MQ: from 09-00 through 10-00-; JP1/Performance Management - Agent Option for JP1/AJS3: from 09-00 through 10-00-; JP1/Performance Management - Agent Option for OpenTP1: from 09-00 through 10-00-; JP1/Performance Management - Agent Option for Oracle WebLogic Server: from 09-00 through 10-00-; JP1/Performance Management - Agent Option for uCosminexus Application Server: from 09-00 through 10-00-; JP1/Performance Management - Agent Option for Virtual Machine: from 09-00 through 09-01-*.
Publication Date	Oct. 3, 2023, 11:15 a.m.
Registration Date	Oct. 3, 2023, 4 p.m.
Last Update	Nov. 21, 2024, 5:17 p.m.

CVSS3.1 : HIGH
スコア	7.8
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:hitachi:jp1\/performance_management:-:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows:-:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html		Vendor Advisory
2	https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html		Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-276	不適切なデフォルトパーミッション	https://cwe.mitre.org/data/definitions/276.html

JVN Vulnerability Information

JP1/Performance Management におけるファイルおよびディレクトリパーミッションの脆弱性

Title	JP1/Performance Management におけるファイルおよびディレクトリパーミッションの脆弱性
Summary	JP1/Performance Management にファイルおよびディレクトリパーミッションの脆弱性 (CVE-2023-3440) が存在します。
Possible impacts	想定される影響については、ベンダ情報をご確認ください。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 3, 2023, midnight
Registration Date	Oct. 4, 2023, 1:51 p.m.
Last Update	Jan. 17, 2024, 10:30 a.m.

Affected System

日立

Hitachi Tuning Manager

JP1/Performance Management - Agent Option for Application Server

JP1/Performance Management - Agent Option for Domino

JP1/Performance Management - Agent Option for Enterprise Applications

JP1/Performance Management - Agent Option for HiRDB

JP1/Performance Management - Agent Option for IBM Lotus Domino

JP1/Performance Management - Agent Option for IBM WebSphere Application Server

JP1/Performance Management - Agent Option for IBM WebSphere MQ

JP1/Performance Management - Agent Option for JP1/AJS3

JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server

JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server

JP1/Performance Management - Agent Option for Microsoft(R) SQL Server

JP1/Performance Management - Agent Option for OpenTP1

JP1/Performance Management - Agent Option for Oracle

JP1/Performance Management - Agent Option for Oracle (R) WebLogic Server

JP1/Performance Management - Agent Option for Platform

JP1/Performance Management - Agent Option for Service Response

JP1/Performance Management - Agent Option for Transaction System

JP1/Performance Management - Agent Option for uCosminexus Application Server

JP1/Performance Management - Agent Option for Virtual Machine

JP1/Performance Management - Base

JP1/Performance Management - Manager

JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server

JP1/Performance Management - Remote Monitor for Oracle

JP1/Performance Management - Remote Monitor for Platform

JP1/Performance Management - Remote Monitor for Virtual Machine

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2023-3440	https://www.cve.org/CVERecord?id=CVE-2023-3440
National Vulnerability Database (NVD)
2	CVE-2023-3440	https://nvd.nist.gov/vuln/detail/CVE-2023-3440

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/scap/cwe.html

ベンダー情報

No	Name	URL
Hitachi Software Vulnerability Information
1	hitachi-sec-2023-145	https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html
2	hitachi-sec-2024-104	https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-104/index.html
ソフトウェア製品セキュリティ情報
3	hitachi-sec-2023-145	https://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2023-145/index.html
4	hitachi-sec-2024-104	https://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2024-104/index.html

Change Log

No	Changed Details	Date of change
1	[2023年10月04日] 掲載	Oct. 4, 2023, 1:51 p.m.
2	[2024年01月16日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：日立 (hitachi-sec-2024-104) を追加参考情報：National Vulnerability Database (NVD) (CVE-2023-3440) を追加	Jan. 17, 2024, 10:26 a.m.