CVE-2024-27142

Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL.
Configurations

No configuration.

History

21 Nov 2024, 09:03

Type Values Removed Values Added
References () http://seclists.org/fulldisclosure/2024/Jul/1 - () http://seclists.org/fulldisclosure/2024/Jul/1 -
References () https://jvn.jp/en/vu/JVNVU97136265/index.html - () https://jvn.jp/en/vu/JVNVU97136265/index.html -
References () https://www.toshibatec.com/information/20240531_01.html - () https://www.toshibatec.com/information/20240531_01.html -
References () https://www.toshibatec.com/information/pdf/information20240531_01.pdf - () https://www.toshibatec.com/information/pdf/information20240531_01.pdf -

04 Jul 2024, 05:15

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2024/Jul/1 -

17 Jun 2024, 12:43

Type Values Removed Values Added
Summary
  • (es) Las impresoras Toshiba utilizan comunicación XML para el endpoint API proporcionado por la impresora. Para el endpoint, se utiliza la librería de análisis XML y es vulnerable a una vulnerabilidad de entidad externa XML ciega (XXE) basada en el tiempo. Un atacante puede hacer daño a las impresoras. Un atacante puede explotar el XXE para recuperar información. En cuanto a los productos/modelos/versiones afectados, consulte la URL de referencia.

14 Jun 2024, 03:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-06-14 03:15

Updated : 2024-11-21 09:03


NVD link : CVE-2024-27142

Mitre link : CVE-2024-27142

CVE.ORG link : CVE-2024-27142


JSON object : View

Products Affected

No product.

CWE
CWE-776

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')