Vulnerability · Published Sep 10, 2024 · Assigned by jpcert
CVE-2024-45504
Medium 6.5
In plain English
A medium-severity cross-site request forgery in InterSafe CATS from Alps System Integration Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 75.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Alps System Integration Co., Ltd. | InterSafe WebFilter | prior to V9.1SP4 Build1653 |
| Alps System Integration Co., Ltd. | InterSafe LogDirector | versions before the replacement file released on 2024 September 9 |
| Alps System Integration Co., Ltd. | InterSafe GatewayConnection | versions before 2024 July 20 maintenance |
| Alps System Integration Co., Ltd. | InterSafe LogNavigator | prior to Ver.1.1.1 |
| Alps System Integration Co., Ltd. | InterSafe CATS | versions before 2024 July 4 maintenance |
| Alps System Integration Co., Ltd. | InterSafe MobileSecurity | versions before 2024 August 31 maintenance |
| Trend Micro Incorporated | InterScan WebManager | 9.09.0 Service Pack 19.19.1 Service Pack 19.1 Service Pack 29.1 Service Pack 3and 9.1 Service Pack 4 |
| MIROKU JYOHO SERVICE CO., LTD. | MJS WebFiltering | versions before 2024 July 4 maintenance |
| Hammock Corporation | AssetView F | versions before 2024 July 4 maintenance |
| MOTEX Inc. | LANSCOPE EndpointManager WebFiltering | versions before 2024 July 4 maintenance |
| AXSEED,Inc. | SPPM BizBrowser | versions before 2024 June 18 maintenance |
| AXSEED,Inc. | SPPM Secure Filtering | versions before 2024 July 20 maintenance |
| QualitySoft Corporation | URL Filtering | versions before 2024 July 4 maintenance |
| JMA Systems Corporation | KAITO SecureBrowser | versions before 2024 July 4 maintenance |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N