CVE-2024-27142CWE-776

Pre-authenticated XXE injection

Medium · published June 14, 2024

CVSS v3.1
5.9
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00920 · 59.9th percentile
Weakness
CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Published
2024-06-14T02:28Z
EPSS history
Timeline
  • 14 JUN 02:28Z
    Pre-authenticated XXE injection
    cvelistv5