cnvd - cnvd-2022-61445

cnvd-2022-61445

Vulnerability from cnvd

Title: Kyocera d-COLOR MF3555跨站脚本漏洞

Description:

Kyocera d-COLOR MF3555是日本Kyocera公司的一款彩色多功能打印机。

Kyocera d-COLOR MF3555 2XD_S000.002.271设备存在跨站脚本漏洞，该漏洞源于在将参数保存到服务器之前，Web应用程序未正确检查参数，攻击者可利用此漏洞通过在/dvcset/sysset/set.cgi post请求中arg01.hostname字段执行JavaScript代码。

Severity: 中

Formal description:

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://www.gruppotim.it/it/footer/red-team.html

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-25344

Impacted products

Name
KYOCERA d-COLOR MF3555 2XD_S000.002.271

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-25344",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-25344"
    }
  },
  "description": "Kyocera d-COLOR MF3555\u662f\u65e5\u672cKyocera\u516c\u53f8\u7684\u4e00\u6b3e\u5f69\u8272\u591a\u529f\u80fd\u6253\u5370\u673a\u3002\n\nKyocera d-COLOR MF3555 2XD_S000.002.271\u8bbe\u5907\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u5c06\u53c2\u6570\u4fdd\u5b58\u5230\u670d\u52a1\u5668\u4e4b\u524d\uff0cWeb\u5e94\u7528\u7a0b\u5e8f\u672a\u6b63\u786e\u68c0\u67e5\u53c2\u6570\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u901a\u8fc7\u5728/dvcset/sysset/set.cgi post\u8bf7\u6c42\u4e2darg01.hostname\u5b57\u6bb5\u6267\u884cJavaScript\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://www.gruppotim.it/it/footer/red-team.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-61445",
  "openTime": "2022-09-02",
  "products": {
    "product": "KYOCERA d-COLOR MF3555 2XD_S000.002.271"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-25344",
  "serverity": "\u4e2d",
  "submitTime": "2022-04-22",
  "title": "Kyocera d-COLOR MF3555\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2022-25344 (GCVE-0-2022-25344)

Vulnerability from cvelistv5

Published

2022-04-20 12:52

Modified

2024-08-03 04:36

Severity ?

CWE

Summary

An XSS issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application doesn't properly check parameters, sent in a /dvcset/sysset/set.cgi POST request via the arg01.Hostname field, before saving them on the server. In addition, the JavaScript malicious content is then reflected back to the end user and executed by the web browser.

References

▼	URL	Tags
	https://www.gruppotim.it/it/footer/red-team.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:36:06.842Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.gruppotim.it/it/footer/red-team.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An XSS issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application doesn\u0027t properly check parameters, sent in a /dvcset/sysset/set.cgi POST request via the arg01.Hostname field, before saving them on the server. In addition, the JavaScript malicious content is then reflected back to the end user and executed by the web browser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-11T14:10:37",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.gruppotim.it/it/footer/red-team.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-25344",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An XSS issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application doesn\u0027t properly check parameters, sent in a /dvcset/sysset/set.cgi POST request via the arg01.Hostname field, before saving them on the server. In addition, the JavaScript malicious content is then reflected back to the end user and executed by the web browser."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.gruppotim.it/it/footer/red-team.html",
              "refsource": "MISC",
              "url": "https://www.gruppotim.it/it/footer/red-team.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-25344",
    "datePublished": "2022-04-20T12:52:05",
    "dateReserved": "2022-02-18T00:00:00",
    "dateUpdated": "2024-08-03T04:36:06.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted