PT-2024-1904 · Hitachi · Hitachi Global Link Manager

Published 2024-01-19 · Updated 2025-02-12 · CVE-2024-0715

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Global Link Manager versions prior to 8.8.7-03

Description The issue is related to an Expression Language Injection vulnerability in Hitachi Global Link Manager on Windows, allowing code injection. This vulnerability can be exploited by a remote attacker to execute arbitrary code. The vulnerability is associated with the failure to neutralize special elements used in the expression language operator.

Recommendations For versions prior to 8.8.7-03, update to version 8.8.7-03 or later to resolve the issue. As a temporary workaround, consider restricting access to the expression language operator to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-917

Related Identifiers

BDU:2024-01680

CVE-2024-0715

Affected Products

Hitachi Global Link Manager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-0715 · Security Note
• https://hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-112/index.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01680 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0715 · Vendor Advisory
• https://hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-112/index.html#action · Note
• https://twitter.com/CVEnew/status/1759757916783972745 · Twitter Post
• https://t.me/cvenotify/111081 · Telegram Post
• https://twitter.com/cracbot/status/1760182613799776279 · Twitter Post
• https://vuldb.com/?id.254145 · Note