JVNDB-2024-000095

Multiple Alps System Integration products and the OEM products vulnerable to cross-site request forgery

Multiple Alps System Integration products and the OEM products contain a cross-site request forgery vulnerability (CWE-352).

Yoshiaki komeyama of KOBELCO SYSTEMS CORPORATION reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Alps System Integration Co., Ltd.

• InterSafe CATS
• InterSafe GatewayConnection
• InterSafe LogDirector
• InterSafe LogNavigator
• InterSafe MobileSecurity
• InterSafe WebFilter

MOTEX Inc.

• LANSCOPE Endpoint Manager Web Filtering

QualitySoft Corporation

• URL Filtering

Trend Micro, Inc.

• InterScan WebManager

AXSEED,Inc.

• SPPM BizBrowser
• SPPM Secure Filtering

JMA Systems Corporation

• KAITO Secure Browser

Hammock Corporation

• AssetView F

MIROKU JYOHO SERVICE CO., LTD. (MJS)

• MJS Web Filtering

For more details, refer to the information provided by the developer.

If a user views a malicious page while logged in, unintended operations may be performed.

[Update the software or apply the workaround]
Update the software to the latest version or apply the workaround according to the information provided by the developer.

Note that the vulnerability in the following products was addressed. Therefore, no action is required from the users.


Alps System Integration Co., Ltd.

• InterSafe GatewayConnection (Measures completion date: July 20, 2024)


• InterSafe CATS (Measures completion date: July 4, 2024)


• InterSafe MobileSecurity (Measures completion date: August 31, 2024)

MIROKU JYOHO SERVICE CO., LTD.

• MJS WebFiltering (Measures completion date: July 4, 2024)

Hammock Corporation

• AssetView F (Measures completion date: July 4, 2024)

MOTEX Inc.

• LANSCOPE EndpointManager WebFiltering (Measures completion date: July 4, 2024)

AXSEED,Inc.

• SPPM BizBrowser (Measures completion date: June 18, 2024)


• SPPM Secure Filtering (Measures completion date: July 20, 2024)

QualitySoft Corporation

• URL Filtering (Measures completion date: July 4, 2024)

JMA Systems Corporation

• KAITO SecureBrowser (Measures completion date: July 4, 2024)

For more details, refer to the information provided by the developer.

Alps System Integration Co., Ltd.

• Alps System Integration Co., Ltd. : Multiple InterSafe products contain a cross-site request forgery vulnerability (in Japanese)

MOTEX Inc.

• MOTEX.Inc : [For Web Filtering users]Cross-Site Request Forgery Vulnerability (in Japanese)

Trend Micro, Inc.

• Trend Micro Incorporated : Alert/Advisory: Vulnerability of Cross-Site Request Forgery (CSRF) in InterScan WebManager (in Japanese)

1. Cross-Site Request Forgery(CWE-352) [IPA Evaluation]

1. CVE-2024-45504

1. JVN : JVN#05579230

• [2024/09/09]
    Web page was published
• [2024/09/11]
    Vendor Information : Content was added