CVE-2024-27163

{"id": "CVE-2024-27163", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-06-14T04:15:32.067", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Jul/1", "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0"}, {"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html", "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0"}, {"url": "https://www.toshibatec.com/information/20240531_01.html", "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0"}, {"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf", "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API. An attacker stealing the cookie of an admin or abusing a XSS vulnerability can recover this password in clear-text and compromise the printer. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the \"Base Score\" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.\n https://www.toshibatec.com/contacts/products/ \nAs for the affected products/models/versions, see the reference URL."}, {"lang": "es", "value": "Las impresoras Toshiba mostrar\u00e1n la contrase\u00f1a del usuario administrador en texto plano y contrase\u00f1as adicionales al enviar 2 solicitudes HTTP espec\u00edficas a la API interna. Un atacante que roba la cookie de un administrador o abusa de una vulnerabilidad XSS puede recuperar esta contrase\u00f1a en texto plano y comprometer la impresora. Esta vulnerabilidad se puede ejecutar en combinaci\u00f3n con otras vulnerabilidades y es dif\u00edcil de ejecutar sola. Por lo tanto, la puntuaci\u00f3n CVSS para esta vulnerabilidad por s\u00ed sola es inferior a la puntuaci\u00f3n que figura en la \"Puntuaci\u00f3n base\" de esta vulnerabilidad. Para obtener detalles sobre otras vulnerabilidades relacionadas, consulte al siguiente punto de contacto. https://www.toshibatec.com/contacts/products/ En cuanto a los productos/modelos/versiones afectados, consulte la URL de referencia."}], "lastModified": "2024-07-04T05:15:13.560", "sourceIdentifier": "ecc0f906-8666-484c-bcf8-c3b7520a72f0"}