CVE-2023-3440

File and Directory Permission Vulnerability in JP1/Performance Management

State: Published
Severity: 8.4 High
Published: Oct 3, 2023
Updated: Aug 2, 2024
Reserved: Jun 28, 2023

Description

Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Management - Manager: from 09-00 before 12-50-07; JP1/Performance Management - Base: from 09-00 through 10-50-*; JP1/Performance Management - Agent Option for Application Server: from 11-00 before 11-50-16; JP1/Performance Management - Agent Option for Enterprise Applications: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for HiRDB: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for IBM Lotus Domino: from 10-00 before 11-50-16; JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Agent Option for Platform: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Service Response: from 09-00 before 11-50-16; JP1/Performance Management - Agent Option for Transaction System: from 11-00 before 12-00-14; JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Remote Monitor for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Platform: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Virtual Machine: from 10-00 before 12-50-07; JP1/Performance Management - Agent Option for Domino: from 09-00 through 09-00-*; JP1/Performance Management - Agent Option for IBM WebSphere Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for IBM WebSphere MQ: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for JP1/AJS3: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for OpenTP1: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Oracle WebLogic Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for uCosminexus Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Virtual Machine: from 09-00 through 09-01-*.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Hitachi

Weaknesses

CWE-276 Incorrect Default Permissions

Affected Products

Product	Versions
JP1/Performance Management - ManagerHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected 12-10 to before 12-10-08Affectedfrom 12-10-08Not affected 12-50 to before 12-50-07Affectedfrom 12-50-07Not affected
JP1/Performance Management - BaseHitachi	09-00 through 10-50-*Affected
JP1/Performance Management - Agent Option for Application ServerHitachi	11-00 to before 11-50-16Affectedfrom 11-50-16Not affected
JP1/Performance Management - Agent Option for Enterprise ApplicationsHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected
JP1/Performance Management - Agent Option for HiRDBHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected
JP1/Performance Management - Agent Option for IBM Lotus DominoHitachi	10-00 to before 11-50-16Affectedfrom 11-50-16Not affected
JP1/Performance Management - Agent Option for Microsoft(R) Exchange ServerHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected
JP1/Performance Management - Agent Option for Microsoft(R) Internet Information ServerHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected
JP1/Performance Management - Agent Option for Microsoft(R) SQL ServerHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected 12-50 to before 12-50-07Affectedfrom 12-50-07Not affected
JP1/Performance Management - Agent Option for OracleHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected 12-10 to before 12-10-08Affectedfrom 12-10-08Not affected
JP1/Performance Management - Agent Option for PlatformHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected 12-50 to before 12-50-07Affectedfrom 12-50-07Not affected
JP1/Performance Management - Agent Option for Service ResponseHitachi	09-00 to before 11-50-16Affectedfrom 11-50-16Not affected
JP1/Performance Management - Agent Option for Transaction SystemHitachi	11-00 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected
JP1/Performance Management - Remote Monitor for Microsoft(R) SQL ServerHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected 12-50 to before 12-50-07Affectedfrom 12-50-07Not affected
JP1/Performance Management - Remote Monitor for OracleHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected 12-10 to before 12-10-08Affectedfrom 12-10-08Not affected
JP1/Performance Management - Remote Monitor for PlatformHitachi	09-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected 12-10 to before 12-10-08Affectedfrom 12-10-08Not affected
JP1/Performance Management - Remote Monitor for Virtual MachineHitachi	10-00 to before 11-50Affected 11-50 to before 11-50-16Affectedfrom 11-50-16Not affected 12-00 to before 12-00-14Affectedfrom 12-00-14Not affected 12-10 to before 12-10-08Affectedfrom 12-10-08Not affected 12-50 to before 12-50-07Affectedfrom 12-50-07Not affected
JP1/Performance Management - Agent Option for DominoHitachi	09-00 through 09-00-*Affected
JP1/Performance Management - Agent Option for IBM WebSphere Application ServerHitachi	09-00 through 10-00-*Affected
JP1/Performance Management - Agent Option for IBM WebSphere MQHitachi	09-00 through 10-00-*Affected
JP1/Performance Management - Agent Option for JP1/AJS3Hitachi	09-00 through 10-00-*Affected
JP1/Performance Management - Agent Option for OpenTP1Hitachi	09-00 through 10-00-*Affected
JP1/Performance Management - Agent Option for Oracle WebLogic ServerHitachi	09-00 through 10-00-*Affected
JP1/Performance Management - Agent Option for uCosminexus Application ServerHitachi	09-00 through 10-00-*Affected
JP1/Performance Management - Agent Option for Virtual MachineHitachi	09-00 through 09-01-*Affected

References

https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.htmlvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.