Vulnerability in Hitachi Jp1\/performance Management
CVE-2023-3440
Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Management - Manager: from 09-00 before 12-50-07; JP1/Performance Management - Base: from 09-00 through 10-50-*; JP1/Performance Management - Agent Option for Application Server: from 11-00 before 11-50-16; JP1/Performance Management - Agent Option for Enterprise Applications: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for HiRDB: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for IBM Lotus Domino: from 10-00 before 11-50-16; JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Agent Option for Platform: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Service Response: from 09-00 before 11-50-16; JP1/Performance Management - Agent Option for Transaction System: from 11-00 before 12-00-14; JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Remote Monitor for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Platform: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Virtual Machine: from 10-00 before 12-50-07; JP1/Performance Management - Agent Option for Domino: from 09-00 through 09-00-*; JP1/Performance Management - Agent Option for IBM WebSphere Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for IBM WebSphere MQ: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for JP1/AJS3: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for OpenTP1: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Oracle WebLogic Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for uCosminexus Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Virtual Machine: from 09-00 through 09-01-*.
EPSS: 0.002 (8.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Hitachi Jp1\/performance_management
- Hitachi Jp1/performance Management - Agent Option For Application Server — versions 11-00
- Hitachi Jp1/performance Management - Agent Option For Domino — versions 09-00
- Hitachi Jp1/performance Management - Agent Option For Enterprise Applications — versions 09-00, 11-50, 12-00
- Hitachi Jp1/performance Management - Agent Option For Hirdb — versions 09-00, 11-50, 12-00
- Hitachi Jp1/performance Management - Agent Option For Ibm Lotus Domino — versions 10-00
- Hitachi Jp1/performance Management - Agent Option For Ibm Websphere Application Server — versions 09-00
- Hitachi Jp1/performance Management - Agent Option For Ibm Websphere Mq — versions 09-00
- Hitachi Jp1/performance Management - Agent Option For Jp1/ajs3 — versions 09-00
- Hitachi Jp1/performance Management - Agent Option For Microsoft(r) Exchange Server — versions 09-00, 11-50, 12-00
Weakness classification (CWE)
Public proof-of-concept exploits
References
- hirt@hitachi.co.jp (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-3440?
- CVE-2023-3440 is a high-severity vulnerability in Hitachi Jp1\/performance Management, classified under Incorrect Default Permissions. CVSS score: 8.4/10. Published 2023-10-03.
- How severe is CVE-2023-3440?
- High severity. CVSS v3 base score is 8.4 out of 10.
- Is CVE-2023-3440 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.