CVE-2024-47045

Sept. 26, 2024, 3:35 p.m.

7.8
High

Description

Privilege chaining issue exists in the installer of e-Tax software(common program). If this vulnerability is exploited, a malicious DLL prepared by an attacker may be executed with higher privileges than the application privilege.

Product(s) Impacted

Product Versions
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Home GateWay/Hikari Denwa routers
  • []
NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION Home GateWay/Hikari Denwa routers
  • []
e-Tax software
  • ['UNKNOWN']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-268
Privilege Chaining
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
CWE-451
User Interface (UI) Misrepresentation of Critical Information
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

References

https://jvn.jp/en/jp/JVN57749899/
https://www.e-tax.nta.go.jp/topics/2024/topics_20240924_versionup.htm

Tags

vultures@jpcert.or.jp
CWE-451
2024-09-26
CVE-2024-47045
CWE-268

CVSS Score

7.8 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    View Vector String

Timeline

Published: Sept. 26, 2024, 4:15 a.m.
Last Modified: Sept. 26, 2024, 3:35 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

vultures@jpcert.or.jp

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.