File and Directory Permission Vulnerability in JP1/Performance Management

Description

Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Management - Manager: from 09-00 before 12-50-07; JP1/Performance Management - Base: from 09-00 through 10-50-*; JP1/Performance Management - Agent Option for Application Server: from 11-00 before 11-50-16; JP1/Performance Management - Agent Option for Enterprise Applications: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for HiRDB: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for IBM Lotus Domino: from 10-00 before 11-50-16; JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server: from 09-00 before  12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server: from 09-00 before 12-00-14; JP1/Performance Management - Agent Option for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Oracle: from 09-00 before  12-10-08; JP1/Performance Management - Agent Option for Platform: from 09-00 before 12-50-07; JP1/Performance Management - Agent Option for Service Response: from 09-00 before 11-50-16; JP1/Performance Management - Agent Option for Transaction System: from 11-00 before 12-00-14; JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server: from 09-00 before 12-50-07; JP1/Performance Management - Remote Monitor for Oracle: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Platform: from 09-00 before 12-10-08; JP1/Performance Management - Remote Monitor for Virtual Machine: from 10-00 before 12-50-07; JP1/Performance Management - Agent Option for Domino: from 09-00 through 09-00-*; JP1/Performance Management - Agent Option for IBM WebSphere Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for IBM WebSphere MQ: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for JP1/AJS3: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for OpenTP1: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Oracle WebLogic Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for uCosminexus Application Server: from 09-00 through 10-00-*; JP1/Performance Management - Agent Option for Virtual Machine: from 09-00 through 09-01-*.

Scores

EPSS (exploitation in 30 days)

0.20% · top 90% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.

Weakness

• CWE-276 Incorrect Default Permissions (opens in a new tab)All about CWE-276 and its CVEs

Affected products

• Hitachi · JP1/Performance Management - Manager

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14
  • affected 12-10 – < 12-10-08
  • affected 12-50 – < 12-50-07

• Hitachi · JP1/Performance Management - Base

  • affected 09-00 – ≤ 10-50-*

• Hitachi · JP1/Performance Management - Agent Option for Application Server

  • affected 11-00 – < 11-50-16

• Hitachi · JP1/Performance Management - Agent Option for Enterprise Applications

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14

• Hitachi · JP1/Performance Management - Agent Option for HiRDB

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14

• Hitachi · JP1/Performance Management - Agent Option for IBM Lotus Domino

  • affected 10-00 – < 11-50-16

• Hitachi · JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14

• Hitachi · JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14

• Hitachi · JP1/Performance Management - Agent Option for Microsoft(R) SQL Server

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14
  • affected 12-50 – < 12-50-07

• Hitachi · JP1/Performance Management - Agent Option for Oracle

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14
  • affected 12-10 – < 12-10-08

• Hitachi · JP1/Performance Management - Agent Option for Platform

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14
  • affected 12-50 – < 12-50-07

• Hitachi · JP1/Performance Management - Agent Option for Service Response

  • affected 09-00 – < 11-50-16

• Hitachi · JP1/Performance Management - Agent Option for Transaction System

  • affected 11-00 – < 11-50-16
  • affected 12-00 – < 12-00-14

• Hitachi · JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14
  • affected 12-50 – < 12-50-07

• Hitachi · JP1/Performance Management - Remote Monitor for Oracle

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14
  • affected 12-10 – < 12-10-08

• Hitachi · JP1/Performance Management - Remote Monitor for Platform

  • affected 09-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14
  • affected 12-10 – < 12-10-08

• Hitachi · JP1/Performance Management - Remote Monitor for Virtual Machine

  • affected 10-00 – < 11-50
  • affected 11-50 – < 11-50-16
  • affected 12-00 – < 12-00-14
  • affected 12-10 – < 12-10-08
  • affected 12-50 – < 12-50-07

• Hitachi · JP1/Performance Management - Agent Option for Domino

  • affected 09-00 – ≤ 09-00-*

• Hitachi · JP1/Performance Management - Agent Option for IBM WebSphere Application Server

  • affected 09-00 – ≤ 10-00-*

• Hitachi · JP1/Performance Management - Agent Option for IBM WebSphere MQ

  • affected 09-00 – ≤ 10-00-*

• Hitachi · JP1/Performance Management - Agent Option for JP1/AJS3

  • affected 09-00 – ≤ 10-00-*

• Hitachi · JP1/Performance Management - Agent Option for OpenTP1

  • affected 09-00 – ≤ 10-00-*

• Hitachi · JP1/Performance Management - Agent Option for Oracle WebLogic Server

  • affected 09-00 – ≤ 10-00-*

• Hitachi · JP1/Performance Management - Agent Option for uCosminexus Application Server

  • affected 09-00 – ≤ 10-00-*

• Hitachi · JP1/Performance Management - Agent Option for Virtual Machine

  • affected 09-00 – ≤ 09-01-*

References (1)

• https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html (opens in a new tab)vendor-advisoryx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-3440](https://trackcve.app/badge/CVE-2023-3440.svg)](https://trackcve.app/cve/CVE-2023-3440)

Record last updated 2 Aug 2024, 06:55 UTC.