Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL.
References
Configurations
No configuration.
History
21 Nov 2024, 09:03
Type | Values Removed | Values Added |
---|---|---|
References | () http://seclists.org/fulldisclosure/2024/Jul/1 - | |
References | () https://jvn.jp/en/vu/JVNVU97136265/index.html - | |
References | () https://www.toshibatec.com/information/20240531_01.html - | |
References | () https://www.toshibatec.com/information/pdf/information20240531_01.pdf - |
04 Jul 2024, 05:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
17 Jun 2024, 12:43
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
14 Jun 2024, 03:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-06-14 03:15
Updated : 2024-11-21 09:03
NVD link : CVE-2024-27142
Mitre link : CVE-2024-27142
CVE.ORG link : CVE-2024-27142
JSON object : View
Products Affected
No product.
CWE
CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')