Vulnerability · Published Jun 14, 2024 · Assigned by Toshiba

CVE-2024-27162DOM-based XSS

Medium 6.1

In plain English

A medium-severity cross-site scripting in Toshiba Tec e-Studio multi-function peripheral (MFP) from Toshiba Tec Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 21.2% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)21.2%top 2.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the reference URL.

Affected products (as reported)

Vendor	Product	Versions
Toshiba Tec Corporation	Toshiba Tec e-Studio multi-function peripheral (MFP)	see the reference URL

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References