CVE-2022-37406

Опубликовано: 07 дек. 2022

Источник: nvd

CVSS3: 4.8

EPSS Низкий

Описание

Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.

Ссылки

https://jvn.jp/en/jp/JVN24659622/index.html
Third Party Advisory
https://support.ricoh.com/bb/html/dr_ut_e/rc3/model/sp42/sp42.htm
Product
Vendor Advisory
https://support.ricoh.com/bbv2/html/dr_ut_d/ipsio/history/w/bb/pub_j/dr_ut_d/4101044/4101044791/V101/5236968/redirect_CLUTool_DOM/history.htm
Release Notes
Vendor Advisory
https://jvn.jp/en/jp/JVN24659622/index.html
Third Party Advisory
https://support.ricoh.com/bb/html/dr_ut_e/rc3/model/sp42/sp42.htm
Product
Vendor Advisory
https://support.ricoh.com/bbv2/html/dr_ut_d/ipsio/history/w/bb/pub_j/dr_ut_d/4101044/4101044791/V101/5236968/redirect_CLUTool_DOM/history.htm
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:ricoh:aficio_sp_4210n_firmware:*:*:*:*:*:*:*:*

Версия до 1.05 (исключая)

cpe:2.3:h:ricoh:aficio_sp_4210n:-:*:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.00396

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-2v8x-7464-c2fx