Medium severity · published Sep 10, 2024
CVE-2024-45504
Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the…
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
AssetView F · Hammock Corporation
versions before 2024 July 4 maintenance · source: vendor
IC
InterSafe CATS · Alps System Integration Co., Ltd.
versions before 2024 July 4 maintenance · source: vendor
IG
InterSafe GatewayConnection · Alps System Integration Co., Ltd.
versions before 2024 July 20 maintenance · source: vendor
IL
InterSafe LogDirector · Alps System Integration Co., Ltd.
versions before the replacement file released on 2024 September 9 · source: vendor
IL
InterSafe LogNavigator · Alps System Integration Co., Ltd.
prior to Ver.1.1.1 · source: vendor
IM
InterSafe MobileSecurity · Alps System Integration Co., Ltd.
versions before 2024 August 31 maintenance · source: vendor
IW
InterSafe WebFilter · Alps System Integration Co., Ltd.
prior to V9.1SP4 Build1653 · source: vendor
IW
InterScan WebManager · Trend Micro Incorporated
9.0; 9.0 Service Pack 1; 9.1; 9.1 Service Pack 1; 9.1 Service Pack 2; 9.1 Service Pack 3; +1 more · source: vendor
KS
KAITO SecureBrowser · JMA Systems Corporation
versions before 2024 July 4 maintenance · source: vendor
LE
LANSCOPE EndpointManager WebFiltering · MOTEX Inc.
versions before 2024 July 4 maintenance · source: vendor
MW
MJS WebFiltering · MIROKU JYOHO SERVICE CO., LTD.
versions before 2024 July 4 maintenance · source: vendor
SB
SPPM BizBrowser · AXSEED,Inc.
versions before 2024 June 18 maintenance · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45504
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45504
alsifaq.dga.jp
https://alsifaq.dga.jp/faq_detail.html?id=6494
jvn.jp
https://jvn.jp/en/jp/JVN05579230/
success.trendmicro.com
https://success.trendmicro.com/ja-JP/solution/KA-0017618
www.motex.co.jp
https://www.motex.co.jp/news/notice/2024/release240909/