CVE-2024-45504

State: Published
Severity: 6.5 Medium
Published: Sep 10, 2024
Updated: Nov 4, 2024
Reserved: Aug 30, 2024

Description

Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	CISA-ADP

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
InterSafe WebFilterAlps System Integration Co., Ltd.	prior to V9.1SP4 Build1653Affected
InterSafe LogDirectorAlps System Integration Co., Ltd.	versions before the replacement file released on 2024 September 9Affected
InterSafe GatewayConnectionAlps System Integration Co., Ltd.	versions before 2024 July 20 maintenanceAffected
InterSafe LogNavigatorAlps System Integration Co., Ltd.	prior to Ver.1.1.1Affected
InterSafe CATSAlps System Integration Co., Ltd.	versions before 2024 July 4 maintenanceAffected
InterSafe MobileSecurityAlps System Integration Co., Ltd.	versions before 2024 August 31 maintenanceAffected
InterScan WebManagerTrend Micro Incorporated	9.0Affected 9.0 Service Pack 1Affected 9.1Affected 9.1 Service Pack 1Affected 9.1 Service Pack 2Affected 9.1 Service Pack 3Affected and 9.1 Service Pack 4Affected
MJS WebFilteringMIROKU JYOHO SERVICE CO., LTD.	versions before 2024 July 4 maintenanceAffected
AssetView FHammock Corporation	versions before 2024 July 4 maintenanceAffected
LANSCOPE EndpointManager WebFilteringMOTEX Inc.	versions before 2024 July 4 maintenanceAffected
SPPM BizBrowserAXSEED,Inc.	versions before 2024 June 18 maintenanceAffected
SPPM Secure FilteringAXSEED,Inc.	versions before 2024 July 20 maintenanceAffected
URL FilteringQualitySoft Corporation	versions before 2024 July 4 maintenanceAffected
KAITO SecureBrowserJMA Systems Corporation	versions before 2024 July 4 maintenanceAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.