Incorrect authorization in J’s Communication Co., Ltd. RevoWorks Cloud Client
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be executed in the sandbox environment. Even if malware is executed in the sandbox environment, it does not compromise the client's local environment. However, information in the sandbox environment may be disclosed to outside or behaviors of the sandbox environment may be violated by tampering registry.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| J’s Communication Co., Ltd. | RevoWorks Cloud Client | up to 3.0.91 | — | No fix listed | CNA |
- RevoWorks Cloud Client VendorJ’s Communication Co., Ltd. Affected up to 3.0.91 Fixed in — No fix listed CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jscom:revoworks_cloud_client:*:*:*:*:*:*:*:* | — | — | J’s Communication Co., Ltd. |
- cpe:2.3:a:jscom:revoworks_cloud_client:*:*:*:*:*:*:*:* Versions — — ·J’s Communication Co., Ltd.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-47560
- 2026-10-03 Alias added: GHSA-q67q-rg47-hfhr
References
More J’s Communication Co., Ltd. vulnerabilities
- TI-2021-04016 Improper control of program execution vulnerability in RevoWorks Browser 2.1.230 and… CVSS 3.1CRITICAL 9.6
- TI-2021-04017 Improper access control vulnerability in RevoWorks Browser 2.1.230 and earlier allows an… CVSS 3.1CRITICAL 9.3
- TI-2022-10300 Incomplete filtering of special elements vulnerability exists in RevoWorks SCVX using… CVSS 3.1HIGH 7.8
- TI-2025-19632 Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks… CVSS 3.0LOW 2.7
Sources
- CVE-2024-47560 · CVE Program
- CVE-2024-47560 · NVD
- FIRST EPSS
- GHSA-q67q-rg47-hfhr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences