Lucene search

Ecc0f906-8666-484c-bcf8-c3b7520a72f0NVD:CVE-2024-27162

HistoryJun 14, 2024 - 4:15 a.m.

CVE-2024-27162

2024-06-1404:15:31

CWE-79

ecc0f906-8666-484c-bcf8-c3b7520a72f0

web.nvd.nist.gov

toshiba printers

web interface

javascript

xss

admin user

vulnerability

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

15.5%

JSON

Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the reference URL.

References

jvn.jp/en/vu/JVNVU97136265/index.html

www.toshibatec.com/information/20240531_01.html

www.toshibatec.com/information/pdf/information20240531_01.pdf

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

15.5%

JSON

Related for NVD:CVE-2024-27162