[Japanese]
|
JVNDB-2025-000030
|
Reflected cross-site scripting vulnerability in multiple laser printers and MFPs which implement Ricoh Web Image Monitor
|
Web Image Monitor provided by Ricoh Company, Ltd. is an web server included and runs in laser printers and MFPs (multifunction printers).
Web Image Monitor contains the vulnerability listed below.
* Reflected cross-site scripting (CWE-79) - CVE-2025-41393
Juan Pablo Gomez Postigo of Sprocket Security, Niels Eris of HackDefense, and Vincent Theriault of Precicom Technologies Inc. reported this vulnerability to Ricoh Company, Ltd. directly and coordinated. After the coordination, Ricoh Company, Ltd. reported this case to IPA under Information Security Early Warning Partnership, and JPCERT/CC coordinated with Ricoh Company, Ltd. for JVN publication.
|
CVSS V3 Severity: Base Metrics 6.1 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
|
CVSS v4 Severity
Base Metrics: 5.1 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Attack Requirements: None
- Privileges Required: None
- User Interaction: Active
Vulnerable System Impact Metrics
- Confidentiality: None
- Integrity: None
- Availability: None
Subsequent System Impact Metrics
- Confidentiality: Low
- Integrity: Low
- Availability: None
|
|
(Multiple Venders)
|
* Specific products and versions which implement Web Image Monitor
As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed below.
* Ricoh Company, Ltd.
* KONICA MINOLTA JAPAN, INC. (in Japanese)
|
An arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.
|
[Update Web Image Monitor]
Update Web Image Monitor to the latest version according to the information provided by the respective vendors.
|
KONICA MINOLTA, INC.
Ricoh Co., Ltd
|
- Cross-site Scripting(CWE-79) [IPA Evaluation]
|
- CVE-2025-41393
|
- JVN : JVN#20474768
|
- [2025/05/12]
Web page was published
- [2025/07/14]
Title was modified
Overview was modified
Affected Products : Content was modified
Vendor Information : Content was added
Solution was modified
|