CVE-2024-27156 (GCVE-0-2024-27156)

Vulnerability from cvelistv5 – Published: 2024-06-14 03:20 – Updated: 2025-02-13 17:46
VLAI
Title
Leak of authentication sessions in secure logs
Summary
The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
Severity
6.8 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-14 18:15 UTC
CWE
  • CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
Impacted products
Date Public
2024-06-14 02:00
Credits
We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27156",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T18:15:44.657901Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-14T18:15:52.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:27:59.190Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.toshibatec.com/information/20240531_01.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "see the reference URL"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products."
        }
      ],
      "datePublic": "2024-06-14T02:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL."
            }
          ],
          "value": "The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We are not aware of any malicious exploitation by these vulnerabilities.\u003cbr\u003e"
            }
          ],
          "value": "We are not aware of any malicious exploitation by these vulnerabilities."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532 Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-04T05:06:32.872Z",
        "orgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
        "shortName": "Toshiba"
      },
      "references": [
        {
          "url": "https://www.toshibatec.com/information/20240531_01.html"
        },
        {
          "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in the version released on June 14, 2024 and all later versions.\u003cbr\u003e"
            }
          ],
          "value": "This issue is fixed in the version released on June 14, 2024 and all later versions."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-06-14T02:00:00.000Z",
          "value": "Fixes will be released"
        }
      ],
      "title": "Leak of authentication sessions in secure logs",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users.\u003cbr\u003e"
            }
          ],
          "value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
    "assignerShortName": "Toshiba",
    "cveId": "CVE-2024-27156",
    "datePublished": "2024-06-14T03:20:49.798Z",
    "dateReserved": "2024-02-21T02:11:56.735Z",
    "dateUpdated": "2025-02-13T17:46:03.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27156",
      "date": "2026-09-22",
      "epss": "0.00438",
      "percentile": "0.37546"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL."
        },
        {
          "lang": "es",
          "value": "Las cookies de sesi\u00f3n, utilizadas para la autenticaci\u00f3n, se almacenan en registros de texto plano. Un atacante puede recuperar sesiones de autenticaci\u00f3n. Un atacante remoto puede recuperar las credenciales y eludir el mecanismo de autenticaci\u00f3n. En cuanto a los productos/modelos/versiones afectados, consulte la URL de referencia."
        }
      ],
      "id": "CVE-2024-27156",
      "lastModified": "2024-11-21T09:03:58.593",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.5,
            "impactScore": 4.2,
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-06-14T04:15:18.743",
      "references": [
        {
          "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
          "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
        },
        {
          "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
          "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
        },
        {
          "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
          "url": "https://www.toshibatec.com/information/20240531_01.html"
        },
        {
          "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
          "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://www.toshibatec.com/information/20240531_01.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
        }
      ],
      "sourceIdentifier": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-532"
            }
          ],
          "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "Linux"
                ],
                "product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
                "vendor": "Toshiba Tec Corporation",
                "versions": [
                  {
                    "status": "affected",
                    "version": "see the reference URL"
                  }
                ]
              }
            ],
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL."
          },
          {
            "lang": "es",
            "value": "Las cookies de sesi\u00f3n, utilizadas para la autenticaci\u00f3n, se almacenan en registros de texto plano. Un atacante puede recuperar sesiones de autenticaci\u00f3n. Un atacante remoto puede recuperar las credenciales y eludir el mecanismo de autenticaci\u00f3n. En cuanto a los productos/modelos/versiones afectados, consulte la URL de referencia."
          }
        ],
        "id": "CVE-2024-27156",
        "lastModified": "2026-06-17T07:19:17.987",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 4.2,
              "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-27156",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T18:15:44.657901Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-06-14T04:15:18.743",
        "references": [
          {
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
          },
          {
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
          },
          {
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "url": "https://www.toshibatec.com/information/20240531_01.html"
          },
          {
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.toshibatec.com/information/20240531_01.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
          }
        ],
        "sourceIdentifier": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-532"
              }
            ],
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T20:19:45+00:00",
      "cve": "CVE-2024-27156",
      "id": "CVE-2024-27156",
      "initial_release_date": "2024-06-14T02:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Leak of authentication sessions in secure logs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27156.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:27:59.190Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.toshibatec.com/information/20240531_01.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-27156",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-14T18:15:44.657901Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-14T18:15:48.530Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "Linux"
              ],
              "product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
              "vendor": "Toshiba Tec Corporation",
              "versions": [
                {
                  "status": "affected",
                  "version": "see the reference URL"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products."
            }
          ],
          "datePublic": "2024-06-14T02:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL."
                }
              ],
              "value": "The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "We are not aware of any malicious exploitation by these vulnerabilities.\u003cbr\u003e"
                }
              ],
              "value": "We are not aware of any malicious exploitation by these vulnerabilities."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-37",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-532",
                  "description": "CWE-532 Insertion of Sensitive Information into Log File",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-07-04T05:06:32.872Z",
            "orgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "shortName": "Toshiba"
          },
          "references": [
            {
              "url": "https://www.toshibatec.com/information/20240531_01.html"
            },
            {
              "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
            },
            {
              "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
            },
            {
              "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "This issue is fixed in the version released on June 14, 2024 and all later versions.\u003cbr\u003e"
                }
              ],
              "value": "This issue is fixed in the version released on June 14, 2024 and all later versions."
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2024-06-14T02:00:00.000Z",
              "value": "Fixes will be released"
            }
          ],
          "title": "Leak of authentication sessions in secure logs",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users.\u003cbr\u003e"
                }
              ],
              "value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users."
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
        "assignerShortName": "Toshiba",
        "cveId": "CVE-2024-27156",
        "datePublished": "2024-06-14T03:20:49.798Z",
        "dateReserved": "2024-02-21T02:11:56.735Z",
        "dateUpdated": "2025-02-13T17:46:03.200Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.