« Volver al listado

CVE-2024-25091

Estado: AplazadaCrítica (9.1)—

Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks Browser prior to 2.2.95 (when using 'VirusChecker' or 'ThreatChecker' feature). If data containing malware is saved in a specific file format (eml, dmg, vhd, iso, msi), malware may be taken outside the sandboxed environment.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Revoworks — BrowserAIRevoworks — ScvxAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-25091",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-25091",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-05T18:45:40.566724Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "J's Communications Co., Ltd.",
          "product": "RevoWorks SCVX",
          "versions": [
            {
              "status": "affected",
              "version": "prior to scvimage4.10.21_1013"
            }
          ]
        },
        {
          "vendor": "J's Communications Co., Ltd.",
          "product": "RevoWorks Browser",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 2.2.95"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:jscom:revoworks_scvx:*:*:*:*:*:*:*:*"
          ],
          "vendor": "jscom",
          "product": "revoworks_scvx",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.10.21_1013",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:jscom:revoworks_browser:*:*:*:*:*:*:*:*"
          ],
          "vendor": "jscom",
          "product": "revoworks_browser",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.2.95",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-03-01T09:15:09.820",
  "references": [
    {
      "url": "https://jscom.jp/news-20240229/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN35928117/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jscom.jp/news-20240229/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN35928117/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks Browser prior to 2.2.95 (when using 'VirusChecker' or 'ThreatChecker' feature).  If data containing malware is saved in a specific file format (eml, dmg, vhd, iso, msi), malware may be taken outside the sandboxed environment."
    },
    {
      "lang": "es",
      "value": "Existe un problema de falla del mecanismo de protección en RevoWorks SCVX anterior a scvimage4.10.21_1013 (cuando se usa la función 'VirusChecker' o 'ThreatChecker') y en RevoWorks Browser anterior a 2.2.95 (cuando se usa la función 'VirusChecker' o 'ThreatChecker'). Si los datos que contienen malware se guardan en un formato de archivo específico (eml, dmg, vhd, iso, msi), es posible que el malware se saque del entorno aislado."
    }
  ],
  "lastModified": "2026-06-17T07:15:29.527",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}