« Volver al listado

CVE-2023-49108

Estado: ModificadaAlta (8.8)—

Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 (excluding Ver.6.1.1.3a). If this vulnerability is exploited, arbitrary files on the server may be obtained or deleted by a user of the product with specific privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sei-info — Rakrak Document Plus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-49108",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Sumitomo Electric Information Systems Co., Ltd.",
          "product": "RakRak Document Plus",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.3.2.0.0 to Ver.6.4.0.7 (excluding Ver.6.1.1.3a)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-12-04T06:15:07.063",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN46895889/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://rakrak.jp/RakDocSupport/rkspServlet",
      "tags": [
        "Product"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN46895889/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rakrak.jp/RakDocSupport/rkspServlet",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 (excluding Ver.6.1.1.3a). If this vulnerability is exploited, arbitrary files on the server may be obtained or deleted by a user of the product with specific privileges."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de path traversal existe en RakRak Document Plus Ver.3.2.0.0 a Ver.6.4.0.7 (excluyendo Ver.6.1.1.3a). Si se explota esta vulnerabilidad, un usuario del producto con privilegios específicos puede obtener o eliminar archivos arbitrarios en el servidor."
    }
  ],
  "lastModified": "2026-06-17T06:35:23.293",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sei-info:rakrak_document_plus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78633656-A929-4F07-8171-DD135E12BA9A",
              "versionEndExcluding": "6.1.1.3a",
              "versionStartIncluding": "3.2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sei-info:rakrak_document_plus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77C487D1-1D2A-4731-8D28-F40973E64A59",
              "versionEndIncluding": "6.4.0.7",
              "versionStartExcluding": "6.1.1.3a"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}