cvelist/2024/27xxx/CVE-2024-27162.json

{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2024-27162",
        "ASSIGNER": "hdq-toshiba-psirt@ml.toshiba.co.jp",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the reference URL."
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')",
                        "cweId": "CWE-79"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "Toshiba Tec Corporation",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "=",
                                            "version_value": "see the reference URL"
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://www.toshibatec.com/information/20240531_01.html",
                "refsource": "MISC",
                "name": "https://www.toshibatec.com/information/20240531_01.html"
            },
            {
                "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf",
                "refsource": "MISC",
                "name": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
            },
            {
                "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html",
                "refsource": "MISC",
                "name": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
            },
            {
                "url": "http://seclists.org/fulldisclosure/2024/Jul/1",
                "refsource": "MISC",
                "name": "http://seclists.org/fulldisclosure/2024/Jul/1"
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.2.0"
    },
    "source": {
        "discovery": "UNKNOWN"
    },
    "work_around": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users.<br>"
                }
            ],
            "value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users."
        }
    ],
    "exploit": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "We are not aware of any malicious exploitation by these vulnerabilities.<br>"
                }
            ],
            "value": "We are not aware of any malicious exploitation by these vulnerabilities."
        }
    ],
    "solution": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "This issue is fixed in the version released on June 14, 2024 and all later versions.<br>"
                }
            ],
            "value": "This issue is fixed in the version released on June 14, 2024 and all later versions."
        }
    ],
    "credits": [
        {
            "lang": "en",
            "value": "We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products."
        }
    ],
    "impact": {
        "cvss": [
            {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
            }
        ]
    }
}