CVE-2024-48870CWE-79

Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability

Medium · published October 25, 2024

CVSS v3.1
6.2
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability.

If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00346 · 26.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-10-25T06:18Z
EPSS history
Timeline
  • 25 OCT 06:18Z
    Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability
    cvelistv5