{"id":"CVE-2024-45504","state":"PUBLISHED","title":"Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authenticati","description":"Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in.","publishedAt":"2024-09-10T04:35:19.457Z","updatedAt":"2024-11-04T20:53:34.282Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","source":"CISA-ADP"},"assigner":"jpcert","products":["Alps System Integration Co., Ltd. InterSafe WebFilter","Alps System Integration Co., Ltd. InterSafe LogDirector","Alps System Integration Co., Ltd. InterSafe GatewayConnection","Alps System Integration Co., Ltd. InterSafe LogNavigator","Alps System Integration Co., Ltd. InterSafe CATS","Alps System Integration Co., Ltd. InterSafe MobileSecurity","Trend Micro Incorporated InterScan WebManager","MIROKU JYOHO SERVICE CO., LTD. MJS WebFiltering","Hammock Corporation AssetView F","MOTEX Inc. LANSCOPE EndpointManager WebFiltering","AXSEED,Inc. SPPM BizBrowser","AXSEED,Inc. SPPM Secure Filtering","QualitySoft Corporation URL Filtering","JMA Systems Corporation KAITO SecureBrowser"],"affected":[{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe WebFilter","versions":[{"version":"prior to V9.1SP4 Build1653","status":"affected"}]},{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe LogDirector","versions":[{"version":"versions before the replacement file released on 2024 September 9","status":"affected"}]},{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe GatewayConnection","versions":[{"version":"versions before 2024 July 20 maintenance","status":"affected"}]},{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe LogNavigator","versions":[{"version":"prior to Ver.1.1.1","status":"affected"}]},{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe CATS","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]},{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe MobileSecurity","versions":[{"version":"versions before 2024 August 31 maintenance","status":"affected"}]},{"vendor":"Trend Micro Incorporated","product":"InterScan WebManager","versions":[{"version":"9.0","status":"affected"},{"version":"9.0 Service Pack 1","status":"affected"},{"version":"9.1","status":"affected"},{"version":"9.1 Service Pack 1","status":"affected"},{"version":"9.1 Service Pack 2","status":"affected"},{"version":"9.1 Service Pack 3","status":"affected"},{"version":"and 9.1 Service Pack 4","status":"affected"}]},{"vendor":"MIROKU JYOHO SERVICE CO., LTD.","product":"MJS WebFiltering","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]},{"vendor":"Hammock Corporation","product":"AssetView F","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]},{"vendor":"MOTEX Inc.","product":"LANSCOPE EndpointManager WebFiltering","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]},{"vendor":"AXSEED,Inc.","product":"SPPM BizBrowser","versions":[{"version":"versions before 2024 June 18 maintenance","status":"affected"}]},{"vendor":"AXSEED,Inc.","product":"SPPM Secure Filtering","versions":[{"version":"versions before 2024 July 20 maintenance","status":"affected"}]},{"vendor":"QualitySoft Corporation","product":"URL Filtering","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]},{"vendor":"JMA Systems Corporation","product":"KAITO SecureBrowser","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]}],"references":["https://alsifaq.dga.jp/faq_detail.html?id=6494","https://success.trendmicro.com/ja-JP/solution/KA-0017618","https://www.motex.co.jp/news/notice/2024/release240909/","https://jvn.jp/en/jp/JVN05579230/"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/45xxx/CVE-2024-45504.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-45504","state":"PUBLISHED","datePublished":"2024-09-10T04:35:19.457Z","dateUpdated":"2024-11-04T20:53:34.282Z","assignerShortName":"jpcert","assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateReserved":"2024-08-30T14:44:59.684Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in."}],"affected":[{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe WebFilter","versions":[{"version":"prior to V9.1SP4 Build1653","status":"affected"}]},{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe LogDirector","versions":[{"version":"versions before the replacement file released on 2024 September 9","status":"affected"}]},{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe GatewayConnection","versions":[{"version":"versions before 2024 July 20 maintenance","status":"affected"}]},{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe LogNavigator","versions":[{"version":"prior to Ver.1.1.1","status":"affected"}]},{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe CATS","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]},{"vendor":"Alps System Integration Co., Ltd.","product":"InterSafe MobileSecurity","versions":[{"version":"versions before 2024 August 31 maintenance","status":"affected"}]},{"vendor":"Trend Micro Incorporated","product":"InterScan WebManager","versions":[{"version":"9.0","status":"affected"},{"version":"9.0 Service Pack 1","status":"affected"},{"version":"9.1","status":"affected"},{"version":"9.1 Service Pack 1","status":"affected"},{"version":"9.1 Service Pack 2","status":"affected"},{"version":"9.1 Service Pack 3","status":"affected"},{"version":"and 9.1 Service Pack 4","status":"affected"}]},{"vendor":"MIROKU JYOHO SERVICE CO., LTD.","product":"MJS WebFiltering","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]},{"vendor":"Hammock Corporation","product":"AssetView F","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]},{"vendor":"MOTEX Inc.","product":"LANSCOPE EndpointManager WebFiltering","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]},{"vendor":"AXSEED,Inc.","product":"SPPM BizBrowser","versions":[{"version":"versions before 2024 June 18 maintenance","status":"affected"}]},{"vendor":"AXSEED,Inc.","product":"SPPM Secure Filtering","versions":[{"version":"versions before 2024 July 20 maintenance","status":"affected"}]},{"vendor":"QualitySoft Corporation","product":"URL Filtering","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]},{"vendor":"JMA Systems Corporation","product":"KAITO SecureBrowser","versions":[{"version":"versions before 2024 July 4 maintenance","status":"affected"}]}],"references":[{"url":"https://alsifaq.dga.jp/faq_detail.html?id=6494"},{"url":"https://success.trendmicro.com/ja-JP/solution/KA-0017618"},{"url":"https://www.motex.co.jp/news/notice/2024/release240909/"},{"url":"https://jvn.jp/en/jp/JVN05579230/"}],"problemTypes":[{"descriptions":[{"description":"Cross-site request forgery (CSRF)","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"jpcert","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateUpdated":"2024-09-10T04:35:19.457Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-09-10T13:45:48.117386Z","id":"CVE-2024-45504","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","type":"CWE","lang":"en","description":"CWE-352 Cross-Site Request Forgery (CSRF)"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-04T20:53:34.282Z"}}]}}}