{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-41149", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2023-08-24T00:34:39.254Z", "datePublished": "2023-09-06T12:35:22.757Z", "dateUpdated": "2024-09-26T20:40:04.712Z"}, "containers": {"cna": {"affected": [{"vendor": "Thinkingreed Inc. ", "product": "F-RevoCRM ", "versions": [{"version": "version7.3.7 and version7.3.8 ", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running."}], "problemTypes": [{"descriptions": [{"description": "OS command injection", "lang": "en", "type": "text"}]}], "references": [{"url": "https://f-revocrm.jp/2023/08/9394/"}, {"url": "http://jvn.jp/en/jp/JVN78113802/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-09-06T12:35:22.757Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:54:04.326Z"}, "title": "CVE Program Container", "references": [{"url": "https://f-revocrm.jp/2023/08/9394/", "tags": ["x_transferred"]}, {"url": "http://jvn.jp/en/jp/JVN78113802/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-26T20:39:55.186689Z", "id": "CVE-2023-41149", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T20:40:04.712Z"}}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:7.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "474DBB2C-1655-4EFE-AECD-A98C6A6E246B", "vulnerable": true}, {"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:7.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "8C1BF5CB-4DAB-4CB3-879E-05FF74092E4B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running."}, {"lang": "es", "value": "F-RevoCRM versi\u00f3n 7.3.7 y versi\u00f3n 7.3.8 contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo. Si se aprovecha esta vulnerabilidad, un atacante que pueda acceder al producto puede ejecutar un comando del sistema operativo arbitrario en el servidor donde se ejecuta el producto."}], "id": "CVE-2023-41149", "lastModified": "2023-09-08T21:21:47.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-06T13:15:09.117", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "http://jvn.jp/en/jp/JVN78113802/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://f-revocrm.jp/2023/08/9394/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}