CVE-2024-33620

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents including sensitive information on the server may be retrieved by an unauthenticated remote attacker.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-36

Affected software

Vendor	Product	Versions
Fsas Technologies Inc.	FUJITSU Business Application ID Link Manager II	V1.8 and earlier
Fsas Technologies Inc.	FUJITSU Software ID Link Manager	V2.0
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager	V2.3.0; V2.3.1; V2.4; V2.5; V2.6; and V2.7
Fsas Technologies Inc.	FUJITSU Software TIME CREATOR ID Link Manager	V3.0; V3.0.2; V3.0.2.1; and V3.0.3
fujitsu	business_application_id_link_manager_ii	<= 1.8
fujitsu	id_link_manager	2.0
fujitsu	time_creator_id_link_manager	2.3.0
fujitsu	time_creator_id_link_manager	2.3.1
fujitsu	time_creator_id_link_manager	2.4
fujitsu	time_creator_id_link_manager	2.5
fujitsu	time_creator_id_link_manager	2.6
fujitsu	time_creator_id_link_manager	2.7
fujitsu	time_creator_id_link_manager	3.0
fujitsu	time_creator_id_link_manager	3.0.2
fujitsu	time_creator_id_link_manager	3.0.2.1
fujitsu	time_creator_id_link_manager	3.0.3

References

Timeline

Published: Jun 18, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-336215.5In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet CVE-2024-336226.5Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerabilit CVE-2024-336237.5A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6. A specially crafted HTTP request CVE-2024-336244.3Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an unauthenticated user CVE-2024-336259.8CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens CVE-2024-336265.3The LevelOne WBR-6012 router contains a vulnerability within its web application that allows unauthenticated disclosure of sensitive informa CVE-2024-336274.4Server-Side Request Forgery (SSRF) vulnerability in Cusmin Absolutely Glamorous Custom Admin.This issue affects Absolutely Glamorous Custom CVE-2024-336288.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in XforWooCommerce allows PHP Local File Inclus CVE-2024-336294.4Server-Side Request Forgery (SSRF) vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail).This issue affects Auto Featur CVE-2024-33639.8A vulnerability was found in SourceCodester Online Library System 1.0. It has been classified as critical. This affects an unknown part of t CVE-2024-336306.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor a CVE-2024-336316.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor P