CVE-2024-36249

Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://global.sharp/products/copier/info/info_security_2024-05.html
https://jp.sharp/business/print/information/info_security_2024-05.html
https://jvn.jp/en/vu/JVNVU93051062/
https://www.toshibatec.co.jp/information/20240531_02.html
https://www.toshibatec.com/information/20240531_02.html

Configurations

No configuration.

History

No history.

Information

Published : 2024-11-26 08:15

Updated : 2026-06-17 07:36

NVD link : CVE-2024-36249

Mitre link : CVE-2024-36249

CVE.ORG link : CVE-2024-36249

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-36249", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36249", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-26T14:03:17.536595Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "vultures@jpcert.or.jp", "affectedData": [{"vendor": "Sharp Corporation", "product": "Multiple MFPs (multifunction printers)", "versions": [{"status": "affected", "version": "See the information provided by Sharp Corporation listed under [References]"}]}, {"vendor": "Toshiba Tec Corporation", "product": "Multiple MFPs (multifunction printers)", "versions": [{"status": "affected", "version": "See the information provided by Toshiba Tec Corporation listed under [References]"}]}]}], "published": "2024-11-26T08:15:06.580", "references": [{"url": "https://global.sharp/products/copier/info/info_security_2024-05.html", "source": "vultures@jpcert.or.jp"}, {"url": "https://jp.sharp/business/print/information/info_security_2024-05.html", "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/vu/JVNVU93051062/", "source": "vultures@jpcert.or.jp"}, {"url": "https://www.toshibatec.co.jp/information/20240531_02.html", "source": "vultures@jpcert.or.jp"}, {"url": "https://www.toshibatec.com/information/20240531_02.html", "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."}, {"lang": "es", "value": "Existe una vulnerabilidad de cross-site scripting en varias impresoras multifunci\u00f3n de Sharp Corporation y Toshiba Tech Corporation. Si se explota esta vulnerabilidad, se puede ejecutar una secuencia de comandos arbitraria en la p\u00e1gina administrativa de las impresoras multifunci\u00f3n afectadas. En cuanto a los detalles de los nombres de los productos afectados, los n\u00fameros de modelo y las versiones, consulte la informaci\u00f3n proporcionada por los respectivos proveedores que se enumeran en [Referencias]."}], "lastModified": "2026-06-17T07:36:22.280", "sourceIdentifier": "vultures@jpcert.or.jp"}