CVE-2024-47560

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47560", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-09-27T02:31:41.840Z", "datePublished": "2024-10-01T01:00:23.083Z", "dateUpdated": "2024-10-01T14:13:05.394Z"}, "containers": {"cna": {"affected": [{"vendor": "J\u2019s Communication Co., Ltd.", "product": "RevoWorks Cloud Client", "versions": [{"version": "3.0.91 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be executed in the sandbox environment. Even if malware is executed in the sandbox environment, it does not compromise the client's local environment. However, information in the sandbox environment may be disclosed to outside or behaviors of the sandbox environment may be violated by tampering registry."}], "problemTypes": [{"descriptions": [{"description": "Incorrect authorization", "lang": "en-US", "cweId": "CWE-863", "type": "CWE"}]}], "references": [{"url": "https://jscom.jp/news-20240918/"}, {"url": "https://jvn.jp/en/jp/JVN39280069/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-10-01T01:00:23.083Z"}}, "adp": [{"affected": [{"vendor": "jscom", "product": "revoworks_cloud_client", "cpes": ["cpe:2.3:a:jscom:revoworks_cloud_client:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.91", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-01T14:10:49.540532Z", "id": "CVE-2024-47560", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-01T14:13:05.394Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47560", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-01T14:10:49.540532Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jscom:revoworks_cloud_client:*:*:*:*:*:*:*:*"], "vendor": "jscom", "product": "revoworks_cloud_client", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.91", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-01T14:12:59.978Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "J\u2019s Communication Co., Ltd.", "product": "RevoWorks Cloud Client", "versions": [{"status": "affected", "version": "3.0.91 and earlier"}]}], "references": [{"url": "https://jscom.jp/news-20240918/"}, {"url": "https://jvn.jp/en/jp/JVN39280069/"}], "descriptions": [{"lang": "en", "value": "RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be executed in the sandbox environment. Even if malware is executed in the sandbox environment, it does not compromise the client's local environment. However, information in the sandbox environment may be disclosed to outside or behaviors of the sandbox environment may be violated by tampering registry."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect authorization"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-10-01T01:00:23.083Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47560", "state": "PUBLISHED", "dateUpdated": "2024-10-01T14:13:05.394Z", "dateReserved": "2024-09-27T02:31:41.840Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-10-01T01:00:23.083Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "RevoWorks Cloud Client", "vendor": "J\u2019s Communication Co., Ltd.", "versions": [{"status": "affected", "version": "3.0.91 and earlier"}]}], "source": "vultures@jpcert.or.jp"}, {"affectedData": [{"cpes": ["cpe:2.3:a:jscom:revoworks_cloud_client:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "revoworks_cloud_client", "vendor": "jscom", "versions": [{"lessThan": "3.0.91", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be executed in the sandbox environment. Even if malware is executed in the sandbox environment, it does not compromise the client's local environment. However, information in the sandbox environment may be disclosed to outside or behaviors of the sandbox environment may be violated by tampering registry."}, {"lang": "es", "value": "RevoWorks Cloud Client 3.0.91 y versiones anteriores contienen una vulnerabilidad de autorizaci\u00f3n incorrecta. Si se explota esta vulnerabilidad, se pueden ejecutar procesos no deseados en el entorno de la sandbox. Incluso si se ejecuta malware en el entorno de la sandbox, no compromete el entorno local del cliente. Sin embargo, la informaci\u00f3n del entorno de la sandbox puede divulgarse al exterior o se pueden violar los comportamientos del entorno de la sandbox mediante la manipulaci\u00f3n del registro."}], "id": "CVE-2024-47560", "lastModified": "2026-06-17T07:57:18.600", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-47560", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-01T14:10:49.540532Z", "version": "2.0.3"}}]}, "published": "2024-10-01T02:15:10.143", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jscom.jp/news-20240918/"}, {"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN39280069/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{}