RevoWorks Cloud Client Sandbox Process Detection Bypass (CVE-2024-47560)

Vulnerability Information Vulnerability ID: JVN#39280069 Vulnerability Name: RevoWorks Cloud Vulnerability Affected Products: RevoWorks Cloud Client 3.0.91 and earlier versions Description: RevoWorks Cloud is software provided by J's Communication Co., Ltd., designed to create an isolated sandbox environment on the client's local system. The software enables execution of a web browser within the sandbox environment and detects and blocks unauthorized processes. A flaw has been identified where unauthorized processes are not detected (CWE-863). Impact: Unauthorized processes may execute within the sandbox environment. Even if malware runs within the sandbox, the client's local environment remains unaffected. Information within the sandbox environment may be compromised due to tampered registry entries. Solution: Update RevoWorks Cloud Client Follow the developer’s instructions to update to the latest version. Vendor Status: J's Communication Co., Ltd. has confirmed the vulnerability and provided remediation guidance. Reference Links: Vulnerability Information Published by J's Communication Co., Ltd. CVSS Score: CVSS v3: 3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score: 7.8 Credits: J's Communication Co., Ltd. reported this vulnerability via JVN; IPA notified users of the solution via JVN. JPCERT/CC and J's Communication Co., Ltd. coordinated under the Information Security Early Warning Partnership. Additional Information: JPCERT Alert JPCERT Reports CERT Advisory CPNI Advisory TRnotes CVE: CVE-2024-47560 JVN iPedia: JVNDB-2024-000107 Copyright: Copyright (c) 2000-2024 JPCERT/CC and IPA. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

RevoWorks Cloud Client Sandbox Process Detection Bypass (CVE-2024-47560)