Details of VAR-201809-0388

ID

VAR-201809-0388

CVE

CVE-2018-17312

TITLE

RICOH Aficio MP 301 Cross-Site Scripting Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2018-20225 // CNNVD: CNNVD-201809-1112

DESCRIPTION

On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. RICOH Aficio MP 301 The printer contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. RICOHAficio MP301 is a multi-function printer device from Ricoh, Japan. A cross-site scripting vulnerability exists in the address addition area in RICOHAficioMP301. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML by sending the \342\200\230entryNameIn\342\200\231 parameter to the /web/entry/en/address/adrsSetUserWizard.cgi file

Trust: 2.25

sources: NVD: CVE-2018-17312 // JVNDB: JVNDB-2018-010362 // CNVD: CNVD-2018-20225 // VULHUB: VHN-127759

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-20225

AFFECTED PRODUCTS

vendor:	ricoh	model:	aficio mp 301spf	scope:	eq	version:	-	Trust: 1.6
vendor:	ricoh	model:	aficio mp 301spf	scope:	-	version:	-	Trust: 0.8
vendor:	ricoh	model:	aficio mp	scope:	eq	version:	301	Trust: 0.6

sources: CNVD: CNVD-2018-20225 // JVNDB: JVNDB-2018-010362 // CNNVD: CNNVD-201809-1112 // NVD: CVE-2018-17312

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-17312
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-17312
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2018-20225
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201809-1112
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-127759
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-17312
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-20225
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-127759
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-17312
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2018-20225 // VULHUB: VHN-127759 // JVNDB: JVNDB-2018-010362 // CNNVD: CNNVD-201809-1112 // NVD: CVE-2018-17312

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-127759 // JVNDB: JVNDB-2018-010362 // NVD: CVE-2018-17312

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201809-1112

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 149496 // CNNVD: CNNVD-201809-1112

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-010362

PATCH

title:

MP 301SPF

url:

https://www.ricoh-usa.com/en/products/pd/equipment/printers-and-copiers/multifunction-printers-copiers/mp-301spf-black-and-white-laser-multifunction-printer/_/R-416185

Trust: 0.8

sources: JVNDB: JVNDB-2018-010362

EXTERNAL IDS

db:	NVD	id:	CVE-2018-17312	Trust: 3.2
db:	PACKETSTORM	id:	149496	Trust: 3.2
db:	JVNDB	id:	JVNDB-2018-010362	Trust: 0.8
db:	CNVD	id:	CNVD-2018-20225	Trust: 0.6
db:	CNNVD	id:	CNNVD-201809-1112	Trust: 0.6
db:	VULHUB	id:	VHN-127759	Trust: 0.1

sources: CNVD: CNVD-2018-20225 // VULHUB: VHN-127759 // JVNDB: JVNDB-2018-010362 // PACKETSTORM: 149496 // CNNVD: CNNVD-201809-1112 // NVD: CVE-2018-17312

REFERENCES

url:	http://packetstormsecurity.com/files/149496/ricoh-aficio-mp-301-printer-cross-site-scripting.html	Trust: 3.1
url:	https://nvd.nist.gov/vuln/detail/cve-2018-17312	Trust: 0.9
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17312	Trust: 0.8

sources: CNVD: CNVD-2018-20225 // VULHUB: VHN-127759 // JVNDB: JVNDB-2018-010362 // PACKETSTORM: 149496 // CNNVD: CNNVD-201809-1112 // NVD: CVE-2018-17312

CREDITS

Ismail Tasdelen

Trust: 0.1

sources: PACKETSTORM: 149496

SOURCES

db:	CNVD	id:	CNVD-2018-20225
db:	VULHUB	id:	VHN-127759
db:	JVNDB	id:	JVNDB-2018-010362
db:	PACKETSTORM	id:	149496
db:	CNNVD	id:	CNNVD-201809-1112
db:	NVD	id:	CVE-2018-17312

LAST UPDATE DATE

2024-11-23T22:58:51.704000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-20225	date:	2018-09-30T00:00:00
db:	VULHUB	id:	VHN-127759	date:	2018-11-15T00:00:00
db:	JVNDB	id:	JVNDB-2018-010362	date:	2018-12-13T00:00:00
db:	CNNVD	id:	CNNVD-201809-1112	date:	2018-09-26T00:00:00
db:	NVD	id:	CVE-2018-17312	date:	2024-11-21T03:54:13.063

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-20225	date:	2018-09-29T00:00:00
db:	VULHUB	id:	VHN-127759	date:	2018-09-26T00:00:00
db:	JVNDB	id:	JVNDB-2018-010362	date:	2018-12-13T00:00:00
db:	PACKETSTORM	id:	149496	date:	2018-09-25T01:05:14
db:	CNNVD	id:	CNNVD-201809-1112	date:	2018-09-26T00:00:00
db:	NVD	id:	CVE-2018-17312	date:	2018-09-26T22:29:01.730