Improper Access Control in SS1 and Rakuraku PC Cloud Agent
CVE-2023-22335

7.5HIGH

Key Information:

Vendor: Dos Co., Ltd.
Status: Ss1 And Rakuraku Pc Cloud
Vendor: CVE Published:; 6 March 2023

🔔 Create Dos Co., Ltd. Vulnerability Alert

What is CVE-2023-22335?

An improper access control vulnerability exists in SS1 versions up to 13.0.0.40 and Rakuraku PC Cloud Agent versions up to 2.1.8. This vulnerability permits remote attackers to bypass access restrictions, allowing them to download any file within the product's directory. Furthermore, when exploited in conjunction with related vulnerabilities, it may enable attackers to execute arbitrary code with SYSTEM privileges through the introduction of malicious scripts to the affected device.

Affected Version(s)

SS1 and Rakuraku PC Cloud SS1 Ver.13.0.0.40 and earlier, and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier

References

https://www.dos-osaka.co.jp/news/2023/03/230301.html

https://jvn.jp/en/jp/JVN57224029/

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 6, 2023
Vulnerability Reserved
Dec 28, 2022

CVE-2023-22335 Data

JSON