Vulnerability · Published Oct 25, 2024 · Assigned by jpcert
CVE-2024-48870
Medium 6.2
In plain English
A medium-severity cross-site scripting in Sharp Digital Full-color MFPs and Monochrome MFPs from Sharp Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)6.2Medium
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Toshiba Tec Corporation | e-STUDIO 908 | T2.12.h3.00 and earlier versions |
| Toshiba Tec Corporation | e-STUDIO 1058 | T1.01.h4.00 and earlier versions |
| Toshiba Tec Corporation | e-STUDIO 1208 | T1.01.h4.00 and earlier versions |
| Sharp Corporation | Sharp Digital Full-color MFPs and Monochrome MFPs | see the information provided by Sharp Corporation |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N