« Volver al listado

CVE-2023-43825

Estado: ModificadaAlta (7.8)—

La vulnerabilidad de path traversal relative en Shihonkanri Plus Ver9.0.3 y versiones anteriores permite a un atacante local ejecutar un código arbitrario haciendo que un usuario legítimo importe un archivo de copia de seguridad del producto especialmente manipulado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ekakin — Shihonkanri Plus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-43825",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-43825",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-24T14:09:41.406986Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "EKAKIN",
          "product": "Shihonkanri Plus",
          "versions": [
            {
              "status": "affected",
              "version": "Ver9.0.3 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-09-27T15:19:34.613",
  "references": [
    {
      "url": "http://ekakin.la.coocan.jp/index.htm",
      "tags": [
        "Product"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN17434995/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://ekakin.la.coocan.jp/index.htm",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN17434995/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Relative path traversal vulnerability in Shihonkanri Plus Ver9.0.3 and earlier allows a local attacker to execute an arbitrary code by having a legitimate user import a specially crafted backup file of the product.."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de path traversal relative en Shihonkanri Plus Ver9.0.3 y versiones anteriores permite a un atacante local ejecutar un código arbitrario haciendo que un usuario legítimo importe un archivo de copia de seguridad del producto especialmente manipulado."
    }
  ],
  "lastModified": "2026-06-17T06:26:31.223",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ekakin:shihonkanri_plus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25BF5289-099D-4042-95F4-E93DF7B8FD8F",
              "versionEndIncluding": "9.0.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}