CVE-2024-27141CWE-776

Pre-authenticated Time-Based Blind XXE injection

Medium · published June 14, 2024

CVSS v3.1
5.9
EPSS
1%
Percentile
65.8
In the wild
Unconfirmed
What it is

Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers by sending a HTTP request without authentication. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01115 · 65.8th percentile
Weakness
CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Published
2024-06-14T02:21Z
EPSS history
Timeline
  • 14 JUN 02:21Z
    Pre-authenticated Time-Based Blind XXE injection
    cvelistv5