Vulnerability-Lookup

CVE-2024-45504 (GCVE-0-2024-45504)

Vulnerability from cvelistv5 – Published: 2024-09-10 04:35 – Updated: 2024-11-04 20:53

Summary

Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 13:45 UTC

CWE

Cross-site request forgery (CSRF)
CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

jpcert jpcert root

References

4 references

URL	Tags
https://alsifaq.dga.jp/faq_detail.html?id=6494
https://success.trendmicro.com/ja-JP/solution/KA-…
https://www.motex.co.jp/news/notice/2024/release240909/
https://jvn.jp/en/jp/JVN05579230/

Impacted products

14 products

Vendor	Product	Version	CPE status
Alps System Integration Co., Ltd.	InterSafe WebFilter	Affected: prior to V9.1SP4 Build1653	guessed
Alps System Integration Co., Ltd.	InterSafe LogDirector	Affected: versions before the replacement file released on 2024 September 9	guessed
Alps System Integration Co., Ltd.	InterSafe GatewayConnection	Affected: versions before 2024 July 20 maintenance	guessed
Alps System Integration Co., Ltd.	InterSafe LogNavigator	Affected: prior to Ver.1.1.1	guessed
Alps System Integration Co., Ltd.	InterSafe CATS	Affected: versions before 2024 July 4 maintenance	guessed
Alps System Integration Co., Ltd.	InterSafe MobileSecurity	Affected: versions before 2024 August 31 maintenance	guessed
Trend Micro Incorporated	InterScan WebManager	Affected: 9.0 Affected: 9.0 Service Pack 1 Affected: 9.1 Affected: 9.1 Service Pack 1 Affected: 9.1 Service Pack 2 Affected: 9.1 Service Pack 3 Affected: and 9.1 Service Pack 4	guessed
MIROKU JYOHO SERVICE CO., LTD.	MJS WebFiltering	Affected: versions before 2024 July 4 maintenance	guessed
Hammock Corporation	AssetView F	Affected: versions before 2024 July 4 maintenance	guessed
MOTEX Inc.	LANSCOPE EndpointManager WebFiltering	Affected: versions before 2024 July 4 maintenance	guessed
AXSEED,Inc.	SPPM BizBrowser	Affected: versions before 2024 June 18 maintenance	guessed
AXSEED,Inc.	SPPM Secure Filtering	Affected: versions before 2024 July 20 maintenance	guessed
QualitySoft Corporation	URL Filtering	Affected: versions before 2024 July 4 maintenance	guessed
JMA Systems Corporation	KAITO SecureBrowser	Affected: versions before 2024 July 4 maintenance	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45504",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T13:45:48.117386Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T20:53:34.282Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InterSafe WebFilter",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to V9.1SP4 Build1653"
            }
          ]
        },
        {
          "product": "InterSafe LogDirector",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before the replacement file released on 2024 September 9"
            }
          ]
        },
        {
          "product": "InterSafe GatewayConnection",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 20 maintenance"
            }
          ]
        },
        {
          "product": "InterSafe LogNavigator",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to Ver.1.1.1"
            }
          ]
        },
        {
          "product": "InterSafe CATS",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        },
        {
          "product": "InterSafe MobileSecurity",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 August 31 maintenance"
            }
          ]
        },
        {
          "product": "InterScan WebManager",
          "vendor": "Trend Micro Incorporated",
          "versions": [
            {
              "status": "affected",
              "version": "9.0"
            },
            {
              "status": "affected",
              "version": "9.0 Service Pack 1"
            },
            {
              "status": "affected",
              "version": "9.1"
            },
            {
              "status": "affected",
              "version": "9.1 Service Pack 1"
            },
            {
              "status": "affected",
              "version": "9.1 Service Pack 2"
            },
            {
              "status": "affected",
              "version": "9.1 Service Pack 3"
            },
            {
              "status": "affected",
              "version": "and 9.1 Service Pack 4"
            }
          ]
        },
        {
          "product": "MJS WebFiltering",
          "vendor": "MIROKU JYOHO SERVICE CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        },
        {
          "product": "AssetView F",
          "vendor": "Hammock Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        },
        {
          "product": "LANSCOPE EndpointManager WebFiltering",
          "vendor": "MOTEX Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        },
        {
          "product": "SPPM BizBrowser",
          "vendor": "AXSEED,Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 June 18 maintenance"
            }
          ]
        },
        {
          "product": "SPPM Secure Filtering",
          "vendor": "AXSEED,Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 20 maintenance"
            }
          ]
        },
        {
          "product": "URL Filtering",
          "vendor": "QualitySoft Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        },
        {
          "product": "KAITO SecureBrowser",
          "vendor": "JMA Systems Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T04:35:19.457Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://alsifaq.dga.jp/faq_detail.html?id=6494"
        },
        {
          "url": "https://success.trendmicro.com/ja-JP/solution/KA-0017618"
        },
        {
          "url": "https://www.motex.co.jp/news/notice/2024/release240909/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN05579230/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-45504",
    "datePublished": "2024-09-10T04:35:19.457Z",
    "dateReserved": "2024-08-30T14:44:59.684Z",
    "dateUpdated": "2024-11-04T20:53:34.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-45504",
      "date": "2026-09-21",
      "epss": "0.00318",
      "percentile": "0.24936"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in."
        },
        {
          "lang": "es",
          "value": "La vulnerabilidad de cross-site request forgery (CSRF) en varios productos de Alps System Integration y productos OEM permite que un atacante remoto no autenticado secuestre la autenticaci\u00f3n del usuario y realice operaciones no deseadas si el usuario ve una p\u00e1gina maliciosa mientras est\u00e1 conectado."
        }
      ],
      "id": "CVE-2024-45504",
      "lastModified": "2024-11-04T21:35:09.173",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 3.6,
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-09-10T05:15:12.780",
      "references": [
        {
          "source": "vultures@jpcert.or.jp",
          "url": "https://alsifaq.dga.jp/faq_detail.html?id=6494"
        },
        {
          "source": "vultures@jpcert.or.jp",
          "url": "https://jvn.jp/en/jp/JVN05579230/"
        },
        {
          "source": "vultures@jpcert.or.jp",
          "url": "https://success.trendmicro.com/ja-JP/solution/KA-0017618"
        },
        {
          "source": "vultures@jpcert.or.jp",
          "url": "https://www.motex.co.jp/news/notice/2024/release240909/"
        }
      ],
      "sourceIdentifier": "vultures@jpcert.or.jp",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-352"
            }
          ],
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "InterSafe WebFilter",
                "vendor": "Alps System Integration Co., Ltd.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "prior to V9.1SP4 Build1653"
                  }
                ]
              },
              {
                "product": "InterSafe LogDirector",
                "vendor": "Alps System Integration Co., Ltd.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before the replacement file released on 2024 September 9"
                  }
                ]
              },
              {
                "product": "InterSafe GatewayConnection",
                "vendor": "Alps System Integration Co., Ltd.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before 2024 July 20 maintenance"
                  }
                ]
              },
              {
                "product": "InterSafe LogNavigator",
                "vendor": "Alps System Integration Co., Ltd.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "prior to Ver.1.1.1"
                  }
                ]
              },
              {
                "product": "InterSafe CATS",
                "vendor": "Alps System Integration Co., Ltd.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before 2024 July 4 maintenance"
                  }
                ]
              },
              {
                "product": "InterSafe MobileSecurity",
                "vendor": "Alps System Integration Co., Ltd.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before 2024 August 31 maintenance"
                  }
                ]
              },
              {
                "product": "InterScan WebManager",
                "vendor": "Trend Micro Incorporated",
                "versions": [
                  {
                    "status": "affected",
                    "version": "9.0"
                  },
                  {
                    "status": "affected",
                    "version": "9.0 Service Pack 1"
                  },
                  {
                    "status": "affected",
                    "version": "9.1"
                  },
                  {
                    "status": "affected",
                    "version": "9.1 Service Pack 1"
                  },
                  {
                    "status": "affected",
                    "version": "9.1 Service Pack 2"
                  },
                  {
                    "status": "affected",
                    "version": "9.1 Service Pack 3"
                  },
                  {
                    "status": "affected",
                    "version": "and 9.1 Service Pack 4"
                  }
                ]
              },
              {
                "product": "MJS WebFiltering",
                "vendor": "MIROKU JYOHO SERVICE CO., LTD.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before 2024 July 4 maintenance"
                  }
                ]
              },
              {
                "product": "AssetView F",
                "vendor": "Hammock Corporation",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before 2024 July 4 maintenance"
                  }
                ]
              },
              {
                "product": "LANSCOPE EndpointManager WebFiltering",
                "vendor": "MOTEX Inc.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before 2024 July 4 maintenance"
                  }
                ]
              },
              {
                "product": "SPPM BizBrowser",
                "vendor": "AXSEED,Inc.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before 2024 June 18 maintenance"
                  }
                ]
              },
              {
                "product": "SPPM Secure Filtering",
                "vendor": "AXSEED,Inc.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before 2024 July 20 maintenance"
                  }
                ]
              },
              {
                "product": "URL Filtering",
                "vendor": "QualitySoft Corporation",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before 2024 July 4 maintenance"
                  }
                ]
              },
              {
                "product": "KAITO SecureBrowser",
                "vendor": "JMA Systems Corporation",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions before 2024 July 4 maintenance"
                  }
                ]
              }
            ],
            "source": "vultures@jpcert.or.jp"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in."
          },
          {
            "lang": "es",
            "value": "La vulnerabilidad de cross-site request forgery (CSRF) en varios productos de Alps System Integration y productos OEM permite que un atacante remoto no autenticado secuestre la autenticaci\u00f3n del usuario y realice operaciones no deseadas si el usuario ve una p\u00e1gina maliciosa mientras est\u00e1 conectado."
          }
        ],
        "id": "CVE-2024-45504",
        "lastModified": "2026-06-17T07:54:19.993",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-45504",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T13:45:48.117386Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-09-10T05:15:12.780",
        "references": [
          {
            "source": "vultures@jpcert.or.jp",
            "url": "https://alsifaq.dga.jp/faq_detail.html?id=6494"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "url": "https://jvn.jp/en/jp/JVN05579230/"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "url": "https://success.trendmicro.com/ja-JP/solution/KA-0017618"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "url": "https://www.motex.co.jp/news/notice/2024/release240909/"
          }
        ],
        "sourceIdentifier": "vultures@jpcert.or.jp",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T19:49:43+00:00",
      "cve": "CVE-2024-45504",
      "id": "CVE-2024-45504",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-45504",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45504.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 6.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-45504",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T13:45:48.117386Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-352",
                    "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-10T13:45:53.507Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "InterSafe WebFilter",
              "vendor": "Alps System Integration Co., Ltd.",
              "versions": [
                {
                  "status": "affected",
                  "version": "prior to V9.1SP4 Build1653"
                }
              ]
            },
            {
              "product": "InterSafe LogDirector",
              "vendor": "Alps System Integration Co., Ltd.",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before the replacement file released on 2024 September 9"
                }
              ]
            },
            {
              "product": "InterSafe GatewayConnection",
              "vendor": "Alps System Integration Co., Ltd.",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before 2024 July 20 maintenance"
                }
              ]
            },
            {
              "product": "InterSafe LogNavigator",
              "vendor": "Alps System Integration Co., Ltd.",
              "versions": [
                {
                  "status": "affected",
                  "version": "prior to Ver.1.1.1"
                }
              ]
            },
            {
              "product": "InterSafe CATS",
              "vendor": "Alps System Integration Co., Ltd.",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before 2024 July 4 maintenance"
                }
              ]
            },
            {
              "product": "InterSafe MobileSecurity",
              "vendor": "Alps System Integration Co., Ltd.",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before 2024 August 31 maintenance"
                }
              ]
            },
            {
              "product": "InterScan WebManager",
              "vendor": "Trend Micro Incorporated",
              "versions": [
                {
                  "status": "affected",
                  "version": "9.0"
                },
                {
                  "status": "affected",
                  "version": "9.0 Service Pack 1"
                },
                {
                  "status": "affected",
                  "version": "9.1"
                },
                {
                  "status": "affected",
                  "version": "9.1 Service Pack 1"
                },
                {
                  "status": "affected",
                  "version": "9.1 Service Pack 2"
                },
                {
                  "status": "affected",
                  "version": "9.1 Service Pack 3"
                },
                {
                  "status": "affected",
                  "version": "and 9.1 Service Pack 4"
                }
              ]
            },
            {
              "product": "MJS WebFiltering",
              "vendor": "MIROKU JYOHO SERVICE CO., LTD.",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before 2024 July 4 maintenance"
                }
              ]
            },
            {
              "product": "AssetView F",
              "vendor": "Hammock Corporation",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before 2024 July 4 maintenance"
                }
              ]
            },
            {
              "product": "LANSCOPE EndpointManager WebFiltering",
              "vendor": "MOTEX Inc.",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before 2024 July 4 maintenance"
                }
              ]
            },
            {
              "product": "SPPM BizBrowser",
              "vendor": "AXSEED,Inc.",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before 2024 June 18 maintenance"
                }
              ]
            },
            {
              "product": "SPPM Secure Filtering",
              "vendor": "AXSEED,Inc.",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before 2024 July 20 maintenance"
                }
              ]
            },
            {
              "product": "URL Filtering",
              "vendor": "QualitySoft Corporation",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before 2024 July 4 maintenance"
                }
              ]
            },
            {
              "product": "KAITO SecureBrowser",
              "vendor": "JMA Systems Corporation",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions before 2024 July 4 maintenance"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Cross-site request forgery (CSRF)",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-09-10T04:35:19.457Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "url": "https://alsifaq.dga.jp/faq_detail.html?id=6494"
            },
            {
              "url": "https://success.trendmicro.com/ja-JP/solution/KA-0017618"
            },
            {
              "url": "https://www.motex.co.jp/news/notice/2024/release240909/"
            },
            {
              "url": "https://jvn.jp/en/jp/JVN05579230/"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2024-45504",
        "datePublished": "2024-09-10T04:35:19.457Z",
        "dateReserved": "2024-08-30T14:44:59.684Z",
        "dateUpdated": "2024-11-04T20:53:34.282Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-45504

Vulnerability from fkie_nvd - Published: 2024-09-10 05:15 - Updated: 2026-06-17 07:54

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	vultures@jpcert.or.jp	https://alsifaq.dga.jp/faq_detail.html?id=6494
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN05579230/
	vultures@jpcert.or.jp	https://success.trendmicro.com/ja-JP/solution/KA-0017618
	vultures@jpcert.or.jp	https://www.motex.co.jp/news/notice/2024/release240909/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "InterSafe WebFilter",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to V9.1SP4 Build1653"
            }
          ]
        },
        {
          "product": "InterSafe LogDirector",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before the replacement file released on 2024 September 9"
            }
          ]
        },
        {
          "product": "InterSafe GatewayConnection",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 20 maintenance"
            }
          ]
        },
        {
          "product": "InterSafe LogNavigator",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to Ver.1.1.1"
            }
          ]
        },
        {
          "product": "InterSafe CATS",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        },
        {
          "product": "InterSafe MobileSecurity",
          "vendor": "Alps System Integration Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 August 31 maintenance"
            }
          ]
        },
        {
          "product": "InterScan WebManager",
          "vendor": "Trend Micro Incorporated",
          "versions": [
            {
              "status": "affected",
              "version": "9.0"
            },
            {
              "status": "affected",
              "version": "9.0 Service Pack 1"
            },
            {
              "status": "affected",
              "version": "9.1"
            },
            {
              "status": "affected",
              "version": "9.1 Service Pack 1"
            },
            {
              "status": "affected",
              "version": "9.1 Service Pack 2"
            },
            {
              "status": "affected",
              "version": "9.1 Service Pack 3"
            },
            {
              "status": "affected",
              "version": "and 9.1 Service Pack 4"
            }
          ]
        },
        {
          "product": "MJS WebFiltering",
          "vendor": "MIROKU JYOHO SERVICE CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        },
        {
          "product": "AssetView F",
          "vendor": "Hammock Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        },
        {
          "product": "LANSCOPE EndpointManager WebFiltering",
          "vendor": "MOTEX Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        },
        {
          "product": "SPPM BizBrowser",
          "vendor": "AXSEED,Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 June 18 maintenance"
            }
          ]
        },
        {
          "product": "SPPM Secure Filtering",
          "vendor": "AXSEED,Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 20 maintenance"
            }
          ]
        },
        {
          "product": "URL Filtering",
          "vendor": "QualitySoft Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        },
        {
          "product": "KAITO SecureBrowser",
          "vendor": "JMA Systems Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2024 July 4 maintenance"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de cross-site request forgery (CSRF) en varios productos de Alps System Integration y productos OEM permite que un atacante remoto no autenticado secuestre la autenticaci\u00f3n del usuario y realice operaciones no deseadas si el usuario ve una p\u00e1gina maliciosa mientras est\u00e1 conectado."
    }
  ],
  "id": "CVE-2024-45504",
  "lastModified": "2026-06-17T07:54:19.993",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45504",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-10T13:45:48.117386Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-09-10T05:15:12.780",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://alsifaq.dga.jp/faq_detail.html?id=6494"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/jp/JVN05579230/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://success.trendmicro.com/ja-JP/solution/KA-0017618"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.motex.co.jp/news/notice/2024/release240909/"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-V6VM-XFHQ-54QP

Vulnerability from github – Published: 2024-09-10 06:30 – Updated: 2024-11-05 00:31

Details

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-45504"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-10T05:15:12Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in.",
  "id": "GHSA-v6vm-xfhq-54qp",
  "modified": "2024-11-05T00:31:27Z",
  "published": "2024-09-10T06:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45504"
    },
    {
      "type": "WEB",
      "url": "https://alsifaq.dga.jp/faq_detail.html?id=6494"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN05579230"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/ja-JP/solution/KA-0017618"
    },
    {
      "type": "WEB",
      "url": "https://www.motex.co.jp/news/notice/2024/release240909"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

JVNDB-2024-000095

Vulnerability from jvndb - Published: 2024-09-09 07:40 - Updated:2024-09-09 07:40

Severity

6.5 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

Multiple Alps System Integration products and the OEM products vulnerable to cross-site request forgery

Details

Multiple Alps System Integration products and the OEM products contain a cross-site request forgery vulnerability (CWE-352). Yoshiaki komeyama of KOBELCO SYSTEMS CORPORATION reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN05579230/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-45504
	Cross-Site Request Forgery(CWE-352)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	Hammock Corporation	AssetView F
	Alps System Integration Co., Ltd.	InterSafe CATS
	Alps System Integration Co., Ltd.	InterSafe GatewayConnection
	Alps System Integration Co., Ltd.	InterSafe LogDirector
	Alps System Integration Co., Ltd.	InterSafe LogNavigator
	Alps System Integration Co., Ltd.	InterSafe MobileSecurity
	Alps System Integration Co., Ltd.	InterSafe WebFilter
	AXSEED,Inc.	SPPM BizBrowser
	AXSEED,Inc.	SPPM Secure Filtering
	JMA Systems Corporation	KAITO Secure Browser
	MIROKU JYOHO SERVICE CO., LTD. (MJS)	MJS Web Filtering
	MOTEX Inc.	LANSCOPE Endpoint Manager Web Filtering
	QualitySoft Corporation	URL Filtering
	Trend Micro, Inc.	InterScan WebManager

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000095.html",
  "dc:date": "2024-09-09T16:40+09:00",
  "dcterms:issued": "2024-09-09T16:40+09:00",
  "dcterms:modified": "2024-09-09T16:40+09:00",
  "description": "Multiple Alps System Integration products and the OEM products contain a cross-site request forgery vulnerability (CWE-352).\r\n\r\nYoshiaki komeyama of KOBELCO SYSTEMS CORPORATION reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000095.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:hammock:assetview_f",
      "@product": "AssetView F",
      "@vendor": "Hammock Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:alps_system_integration_intersafe_cats",
      "@product": "InterSafe CATS",
      "@vendor": "Alps System Integration Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:alps_system_integration_intersafe_gatewayconnection",
      "@product": "InterSafe GatewayConnection",
      "@vendor": "Alps System Integration Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:alps_system_integration_intersafe_logdirector",
      "@product": "InterSafe LogDirector",
      "@vendor": "Alps System Integration Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:alps_system_integration_intersafe_lognavigator",
      "@product": "InterSafe LogNavigator",
      "@vendor": "Alps System Integration Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:alps_system_integration_intersafe_mobilesecurity",
      "@product": "InterSafe MobileSecurity",
      "@vendor": "Alps System Integration Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:alps_system_integration_intersafe_webfilter",
      "@product": "InterSafe WebFilter",
      "@vendor": "Alps System Integration Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:axseed_sppm_bizbrower",
      "@product": "SPPM BizBrowser",
      "@vendor": "AXSEED,Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:axseed_sppm_secure_filtering",
      "@product": "SPPM Secure Filtering",
      "@vendor": "AXSEED,Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:jmas_kaito_secure_browser",
      "@product": "KAITO Secure Browser",
      "@vendor": "JMA Systems Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:mjs_mjs_web_filtering",
      "@product": "MJS Web Filtering",
      "@vendor": "MIROKU JYOHO SERVICE CO., LTD. (MJS)",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:motex:lanscope_endpoint_manager_web_filtering",
      "@product": "LANSCOPE Endpoint Manager Web Filtering",
      "@vendor": "MOTEX Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:qualitysoft:url_filtering",
      "@product": "URL Filtering",
      "@vendor": "QualitySoft Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:trendmicro:interscan_webmanager",
      "@product": "InterScan WebManager",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "6.5",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000095",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN05579230/index.html",
      "@id": "JVN#05579230",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-45504",
      "@id": "CVE-2024-45504",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "Multiple Alps System Integration products and the OEM products vulnerable to cross-site request forgery"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-45504 (GCVE-0-2024-45504)

FKIE_CVE-2024-45504

GHSA-V6VM-XFHQ-54QP

JVNDB-2024-000095

Tags

Sightings

Nomenclature

Related by attack behaviour