CVE-2024-33620

Published: Jun 18, 2024Modified: Jun 17, 2026Deferred

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 4.0

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents including sensitive information on the server may be retrieved by an unauthenticated remote attacker.

Related CWEs

CWE-36

Absolute Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

References (4)

https://jvn.jp/en/jp/JVN65171386/

Source: vultures@jpcert.or.jp

https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html

Source: vultures@jpcert.or.jp

https://jvn.jp/en/jp/JVN65171386/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.fujitsu.com/jp/group/fsas/about/resources/security/2024/0617.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.