cve-2024-22475
Vulnerability from cvelistv5
Published
2024-03-18 08:03
Modified
2024-10-27 21:26
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Summary
Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. allows a remote unauthenticated attacker to perform unintended operations on the affected product. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
References
vultures@jpcert.or.jphttps://jvn.jp/en/jp/JVN82749078/
vultures@jpcert.or.jphttps://support.brother.com/g/b/link.aspx?prod=group2&faqid=faqp00100601_000
vultures@jpcert.or.jphttps://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faq00100823_000
vultures@jpcert.or.jphttps://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_2_announce.html
vultures@jpcert.or.jphttps://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000002
vultures@jpcert.or.jphttps://www.toshibatec.com/information/20240306_01.html
Impacted products
Vendor Product Version
FUJIFILM Business Innovation Corp. Multiple printers and scanners Version: see the information provided by the vendor
Toshiba Tec Corporation Multiple printers and scanners Version: see the information provided by the vendor
RICOH COMPANY, LTD. Multiple printers and scanners Version: see the information provided by the vendor
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-22475",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T18:18:38.595032Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-27T21:26:34.557Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:51:09.846Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.brother.com/g/b/link.aspx?prod=group2\u0026faqid=faqp00100601_000"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.brother.com/g/b/link.aspx?prod=lmgroup1\u0026faqid=faq00100823_000"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_2_announce.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000002"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.toshibatec.com/information/20240306_01.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN82749078/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple printers and scanners",
          "vendor": "BROTHER INDUSTRIES, LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        },
        {
          "product": "Multiple printers and scanners",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        },
        {
          "product": "Multiple printers and scanners",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        },
        {
          "product": "Multiple printers and scanners",
          "vendor": "RICOH COMPANY, LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. allows a remote unauthenticated attacker to perform unintended operations on the affected product. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T08:03:36.146Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://support.brother.com/g/b/link.aspx?prod=group2\u0026faqid=faqp00100601_000"
        },
        {
          "url": "https://support.brother.com/g/b/link.aspx?prod=lmgroup1\u0026faqid=faq00100823_000"
        },
        {
          "url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_2_announce.html"
        },
        {
          "url": "https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000002"
        },
        {
          "url": "https://www.toshibatec.com/information/20240306_01.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN82749078/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-22475",
    "datePublished": "2024-03-18T08:03:36.146Z",
    "dateReserved": "2024-02-09T04:42:38.473Z",
    "dateUpdated": "2024-10-27T21:26:34.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-22475\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-03-18T08:15:06.173\",\"lastModified\":\"2024-10-27T22:35:03.240\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. allows a remote unauthenticated attacker to perform unintended operations on the affected product. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de Cross-Site Request Forgery en m\u00faltiples impresoras y esc\u00e1neres que implementan administraci\u00f3n basada en web proporcionada por BROTHER INDUSTRIES, LTD. permite que un atacante remoto no autenticado realice operaciones no deseadas en el producto afectado. En cuanto a los detalles de los nombres de productos, n\u00fameros de modelo y versiones afectados, consulte la informaci\u00f3n proporcionada por los respectivos proveedores que figuran en [Referencias].\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN82749078/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://support.brother.com/g/b/link.aspx?prod=group2\u0026faqid=faqp00100601_000\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://support.brother.com/g/b/link.aspx?prod=lmgroup1\u0026faqid=faq00100823_000\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_2_announce.html\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000002\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.toshibatec.com/information/20240306_01.html\",\"source\":\"vultures@jpcert.or.jp\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.