Skip to content
Fencer Vulns
high 8.4

CVE-2023-3440 json

File and Directory Permission Vulnerability in JP1/Performance Management

published 2023-10-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-44104

cvss
8.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Management - Manager: from 09-00 before 12-50-07; JP1/Performance Management - Base: from 09-00 through 10-50-*; JP1/Performance Management - Agent Option for Application Server: from 11-00 before 11-50-16; JP1/Performance Management - Agent Option for Enterprise Applications: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for HiRDB: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for IBM Lotus Domino: from 10-00 before 11-50-16; JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server: from 09-00 before  12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Oracle: from 09-00 before  12-10-08; JP1/Performance Management - Agent Option for Platform: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Service Response: from 09-00 before 11-50-16; JP1/Performance Management - Agent Option for Transaction System: from 11-00 before 12-00-14; JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Remote Monitor for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Platform: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Virtual Machine: from 10-00 before 12-50-07; JP1/Performance Management - Agent Option for Domino: from 09-00 through 09-00-*; JP1/Performance Management - Agent Option for IBM WebSphere Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for IBM WebSphere MQ: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for JP1/AJS3: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for OpenTP1: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Oracle WebLogic Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for uCosminexus Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Virtual Machine: from 09-00 through 09-01-*.

Patch / fix

  • Hitachi JP1/Performance Management - Manager 11-50, 11-50-16, 12-00-14, 12-10-08, 12-50-07
  • Hitachi JP1/Performance Management - Agent Option for Application Server 11-50-16
  • Hitachi JP1/Performance Management - Agent Option for Enterprise Applications 11-50, 11-50-16, 12-00-14
  • Hitachi JP1/Performance Management - Agent Option for HiRDB 11-50, 11-50-16, 12-00-14
  • Hitachi JP1/Performance Management - Agent Option for IBM Lotus Domino 11-50-16
  • Hitachi JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server 11-50, 11-50-16, 12-00-14
  • Hitachi JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server 11-50, 11-50-16, 12-00-14
  • Hitachi JP1/Performance Management - Agent Option for Microsoft(R) SQL Server 11-50, 11-50-16, 12-00-14, 12-50-07
  • Hitachi JP1/Performance Management - Agent Option for Oracle 11-50, 11-50-16, 12-00-14, 12-10-08
  • Hitachi JP1/Performance Management - Agent Option for Platform 11-50, 11-50-16, 12-00-14, 12-50-07
  • Hitachi JP1/Performance Management - Agent Option for Service Response 11-50-16
  • Hitachi JP1/Performance Management - Agent Option for Transaction System 11-50-16, 12-00-14
  • Hitachi JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server 11-50, 11-50-16, 12-00-14, 12-50-07
  • Hitachi JP1/Performance Management - Remote Monitor for Oracle 11-50, 11-50-16, 12-00-14, 12-10-08
  • Hitachi JP1/Performance Management - Remote Monitor for Platform 11-50, 11-50-16, 12-00-14, 12-10-08
  • Hitachi JP1/Performance Management - Remote Monitor for Virtual Machine 11-50, 11-50-16, 12-00-14, 12-10-08, 12-50-07

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Hitachi JP1/Performance Management - Manager
  • Hitachi JP1/Performance Management - Base
  • Hitachi JP1/Performance Management - Agent Option for Application Server
  • Hitachi JP1/Performance Management - Agent Option for Enterprise Applications
  • Hitachi JP1/Performance Management - Agent Option for HiRDB
  • Hitachi JP1/Performance Management - Agent Option for IBM Lotus Domino
  • Hitachi JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server
  • Hitachi JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server
  • Hitachi JP1/Performance Management - Agent Option for Microsoft(R) SQL Server
  • Hitachi JP1/Performance Management - Agent Option for Oracle
  • Hitachi JP1/Performance Management - Agent Option for Platform
  • Hitachi JP1/Performance Management - Agent Option for Service Response
  • Hitachi JP1/Performance Management - Agent Option for Transaction System
  • Hitachi JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server
  • Hitachi JP1/Performance Management - Remote Monitor for Oracle
  • Hitachi JP1/Performance Management - Remote Monitor for Platform
  • Hitachi JP1/Performance Management - Remote Monitor for Virtual Machine
  • Hitachi JP1/Performance Management - Agent Option for Domino
  • Hitachi JP1/Performance Management - Agent Option for IBM WebSphere Application Server
  • Hitachi JP1/Performance Management - Agent Option for IBM WebSphere MQ
  • Hitachi JP1/Performance Management - Agent Option for JP1/AJS3
  • Hitachi JP1/Performance Management - Agent Option for OpenTP1
  • Hitachi JP1/Performance Management - Agent Option for Oracle WebLogic Server
  • Hitachi JP1/Performance Management - Agent Option for uCosminexus Application Server
  • Hitachi JP1/Performance Management - Agent Option for Virtual Machine

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.