[Japanese]

JVNDB-2025-000046

SLNX Help Documentation of RICOH Streamline NX vulnerable to reflected cross-site scripting

Overview

SLNX Help Documentation of RICOH Streamline NX provided by Ricoh Company, Ltd. contains a reflected cross-site scripting vulnerability.

  • Reflected cross-site scripting via a specific parameter (CWE-79) - CVE-2025-41439


Matteo Santini reported this vulnerability to Ricoh Company, Ltd. directly and coordinated. After the coordination, Ricoh Company, Ltd. reported this case to IPA under Information Security Early Warning Partnership, and JPCERT/CC coordinated with Ricoh Company, Ltd. for JVN publication.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 6.1 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
Affected Products


Ricoh Co., Ltd
  • Ricoh Streamline NX versions 3.5.0 to 3.7.2

Impact

An arbitrary script may be executed on the web browser of the user who accessed the product.
Solution

[Update the Software]
Update the software to the latest version according to the information provided by the developer.
The developer has released the following version that addresses this vulnerability.
  • RICOH Streamline NX version 3.231.0 (=23R1) or later
Vendor Information

Ricoh Co., Ltd
CWE (What is CWE?)

  1. Cross-site Scripting(CWE-79) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2025-41439
References

  1. JVN : JVN#24333956
Revision History

  • [2025/06/30]
      Web page was published

Date Public2025/06/30
Date First Published2025/06/30
Date Last Updated2025/06/30