CVE-2024-27974

Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a remote unauthenticated attacker to alter user information. In the case the user is an administrator, the settings such as the administrator's ID, password, etc. may be altered. As for the details of affected product names, model numbers, and versions, refer to the information provided by the vendor listed under [References].

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/jp/JVN34328023/
https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_1_announce.html
https://jvn.jp/en/jp/JVN34328023/
https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_1_announce.html

Configurations

No configuration.

History

No history.

Information

Published : 2024-03-18 08:15

Updated : 2024-11-21 09:05

NVD link : CVE-2024-27974

Mitre link : CVE-2024-27974

CVE.ORG link : CVE-2024-27974

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2024-27974", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2024-03-18T08:15:06.287", "references": [{"url": "https://jvn.jp/en/jp/JVN34328023/", "source": "vultures@jpcert.or.jp"}, {"url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_1_announce.html", "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN34328023/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_1_announce.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a remote unauthenticated attacker to alter user information. In the case the user is an administrator, the settings such as the administrator's ID, password, etc. may be altered. As for the details of affected product names, model numbers, and versions, refer to the information provided by the vendor listed under [References]."}, {"lang": "es", "value": "Vulnerabilidad de Cross-Site Request Forgery en impresoras FUJIFILM que implementan CentreWare Internet Services o Internet Services permite que un atacante remoto no autenticado altere la informaci\u00f3n del usuario. En el caso de que el usuario sea administrador, se podr\u00e1n alterar configuraciones como ID de administrador, contrase\u00f1a, etc. En cuanto a los detalles de los nombres de los productos, n\u00fameros de modelo y versiones afectados, consulte la informaci\u00f3n proporcionada por el proveedor que figura en [Referencias]."}], "lastModified": "2024-11-21T09:05:32.470", "sourceIdentifier": "vultures@jpcert.or.jp"}