CVE-2024-45504

View on CVE.org

Published Sep 10, 2024 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Alps System Integration Co., Ltd.

InterSafe WebFilter

affected

Version	Status	Constraints
`prior to V9.1SP4 Build1653`	affected	—

Alps System Integration Co., Ltd.

InterSafe LogDirector

affected

Version	Status	Constraints
`versions before the replacement file released on 2024 September 9`	affected	—

Alps System Integration Co., Ltd.

InterSafe GatewayConnection

affected

Version	Status	Constraints
`versions before 2024 July 20 maintenance`	affected	—

Alps System Integration Co., Ltd.

InterSafe LogNavigator

affected

Version	Status	Constraints
`prior to Ver.1.1.1`	affected	—

Alps System Integration Co., Ltd.

InterSafe CATS

affected

Version	Status	Constraints
`versions before 2024 July 4 maintenance`	affected	—

Alps System Integration Co., Ltd.

InterSafe MobileSecurity

affected

Version	Status	Constraints
`versions before 2024 August 31 maintenance`	affected	—

Trend Micro Incorporated

InterScan WebManager

affected

Version	Status	Constraints
`9.0`	affected	—
`9.0 Service Pack 1`	affected	—
`9.1`	affected	—
`9.1 Service Pack 1`	affected	—
`9.1 Service Pack 2`	affected	—
`9.1 Service Pack 3`	affected	—
`and 9.1 Service Pack 4`	affected	—

MIROKU JYOHO SERVICE CO., LTD.

MJS WebFiltering

affected

Version	Status	Constraints
`versions before 2024 July 4 maintenance`	affected	—

Hammock Corporation

AssetView F

affected

Version	Status	Constraints
`versions before 2024 July 4 maintenance`	affected	—

MOTEX Inc.

LANSCOPE EndpointManager WebFiltering

affected

Version	Status	Constraints
`versions before 2024 July 4 maintenance`	affected	—

AXSEED,Inc.

SPPM BizBrowser

affected

Version	Status	Constraints
`versions before 2024 June 18 maintenance`	affected	—

AXSEED,Inc.

SPPM Secure Filtering

affected

Version	Status	Constraints
`versions before 2024 July 20 maintenance`	affected	—

QualitySoft Corporation

URL Filtering

affected

Version	Status	Constraints
`versions before 2024 July 4 maintenance`	affected	—

JMA Systems Corporation

KAITO SecureBrowser

affected

Version	Status	Constraints
`versions before 2024 July 4 maintenance`	affected	—

No data.

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.318% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://alsifaq.dga.jp/faq_detail.html?id=6494
https://jvn.jp/en/jp/JVN05579230/
https://success.trendmicro.com/ja-JP/solution/KA-0017618
https://www.motex.co.jp/news/notice/2024/release240909/

History

Nov 4, 2024 9:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-352
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}`

Sep 10, 2024 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 10, 2024 4:45 AM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in.
References		https://alsifaq.dga.jp/faq_detail.html?id=6494 https://jvn.jp/en/jp/JVN05579230/ https://success.trendmicro.com/ja-JP/solution/KA-0017618 https://www.motex.co.jp/news/notice/2024/release240909/

Subscriptions

No data.

Weaknesses

CWE-352

Sources

CVE record Updated: Nov 4, 2024, 8:53 PM

Status: PUBLISHED
Assigner: jpcert
Published: Sep 10, 2024, 4:35 AM
Updated: Nov 4, 2024, 8:53 PM
Reserved: Aug 30, 2024, 2:44 PM

View source JSON

Vulnrichment Updated: Sep 10, 2024, 1:45 PM

Updated: Sep 10, 2024, 1:45 PM

NVD Updated: Jun 17, 2026, 7:54 AM

Status: Deferred
Published: Sep 10, 2024, 5:15 AM
Modified: Jun 17, 2026, 7:54 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45504", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-08-30T14:44:59.684Z", "datePublished": "2024-09-10T04:35:19.457Z", "dateUpdated": "2024-11-04T20:53:34.282Z"}, "containers": {"cna": {"affected": [{"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe WebFilter", "versions": [{"version": "prior to V9.1SP4 Build1653", "status": "affected"}]}, {"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe LogDirector", "versions": [{"version": "versions before the replacement file released on 2024 September 9", "status": "affected"}]}, {"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe GatewayConnection", "versions": [{"version": "versions before 2024 July 20 maintenance", "status": "affected"}]}, {"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe LogNavigator", "versions": [{"version": "prior to Ver.1.1.1", "status": "affected"}]}, {"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe CATS", "versions": [{"version": "versions before 2024 July 4 maintenance", "status": "affected"}]}, {"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe MobileSecurity", "versions": [{"version": "versions before 2024 August 31 maintenance", "status": "affected"}]}, {"vendor": "Trend Micro Incorporated", "product": "InterScan WebManager", "versions": [{"version": "9.0", "status": "affected"}, {"version": "9.0 Service Pack 1", "status": "affected"}, {"version": "9.1", "status": "affected"}, {"version": "9.1 Service Pack 1", "status": "affected"}, {"version": "9.1 Service Pack 2", "status": "affected"}, {"version": "9.1 Service Pack 3", "status": "affected"}, {"version": "and 9.1 Service Pack 4", "status": "affected"}]}, {"vendor": "MIROKU JYOHO SERVICE CO., LTD.", "product": "MJS WebFiltering", "versions": [{"version": "versions before 2024 July 4 maintenance", "status": "affected"}]}, {"vendor": "Hammock Corporation", "product": "AssetView F", "versions": [{"version": "versions before 2024 July 4 maintenance", "status": "affected"}]}, {"vendor": "MOTEX Inc.", "product": "LANSCOPE EndpointManager WebFiltering", "versions": [{"version": "versions before 2024 July 4 maintenance", "status": "affected"}]}, {"vendor": "AXSEED,Inc.", "product": "SPPM BizBrowser", "versions": [{"version": "versions before 2024 June 18 maintenance", "status": "affected"}]}, {"vendor": "AXSEED,Inc.", "product": "SPPM Secure Filtering", "versions": [{"version": "versions before 2024 July 20 maintenance", "status": "affected"}]}, {"vendor": "QualitySoft Corporation", "product": "URL Filtering", "versions": [{"version": "versions before 2024 July 4 maintenance", "status": "affected"}]}, {"vendor": "JMA Systems Corporation", "product": "KAITO SecureBrowser", "versions": [{"version": "versions before 2024 July 4 maintenance", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in."}], "problemTypes": [{"descriptions": [{"description": "Cross-site request forgery (CSRF)", "lang": "en", "type": "text"}]}], "references": [{"url": "https://alsifaq.dga.jp/faq_detail.html?id=6494"}, {"url": "https://success.trendmicro.com/ja-JP/solution/KA-0017618"}, {"url": "https://www.motex.co.jp/news/notice/2024/release240909/"}, {"url": "https://jvn.jp/en/jp/JVN05579230/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-09-10T04:35:19.457Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-10T13:45:48.117386Z", "id": "CVE-2024-45504", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T20:53:34.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-45504", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T13:45:48.117386Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-10T13:45:53.507Z"}}], "cna": {"affected": [{"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe WebFilter", "versions": [{"status": "affected", "version": "prior to V9.1SP4 Build1653"}]}, {"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe LogDirector", "versions": [{"status": "affected", "version": "versions before the replacement file released on 2024 September 9"}]}, {"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe GatewayConnection", "versions": [{"status": "affected", "version": "versions before 2024 July 20 maintenance"}]}, {"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe LogNavigator", "versions": [{"status": "affected", "version": "prior to Ver.1.1.1"}]}, {"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe CATS", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}, {"vendor": "Alps System Integration Co., Ltd.", "product": "InterSafe MobileSecurity", "versions": [{"status": "affected", "version": "versions before 2024 August 31 maintenance"}]}, {"vendor": "Trend Micro Incorporated", "product": "InterScan WebManager", "versions": [{"status": "affected", "version": "9.0"}, {"status": "affected", "version": "9.0 Service Pack 1"}, {"status": "affected", "version": "9.1"}, {"status": "affected", "version": "9.1 Service Pack 1"}, {"status": "affected", "version": "9.1 Service Pack 2"}, {"status": "affected", "version": "9.1 Service Pack 3"}, {"status": "affected", "version": "and 9.1 Service Pack 4"}]}, {"vendor": "MIROKU JYOHO SERVICE CO., LTD.", "product": "MJS WebFiltering", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}, {"vendor": "Hammock Corporation", "product": "AssetView F", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}, {"vendor": "MOTEX Inc.", "product": "LANSCOPE EndpointManager WebFiltering", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}, {"vendor": "AXSEED,Inc.", "product": "SPPM BizBrowser", "versions": [{"status": "affected", "version": "versions before 2024 June 18 maintenance"}]}, {"vendor": "AXSEED,Inc.", "product": "SPPM Secure Filtering", "versions": [{"status": "affected", "version": "versions before 2024 July 20 maintenance"}]}, {"vendor": "QualitySoft Corporation", "product": "URL Filtering", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}, {"vendor": "JMA Systems Corporation", "product": "KAITO SecureBrowser", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}], "references": [{"url": "https://alsifaq.dga.jp/faq_detail.html?id=6494"}, {"url": "https://success.trendmicro.com/ja-JP/solution/KA-0017618"}, {"url": "https://www.motex.co.jp/news/notice/2024/release240909/"}, {"url": "https://jvn.jp/en/jp/JVN05579230/"}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Cross-site request forgery (CSRF)"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-09-10T04:35:19.457Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45504", "state": "PUBLISHED", "dateUpdated": "2024-11-04T20:53:34.282Z", "dateReserved": "2024-08-30T14:44:59.684Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-09-10T04:35:19.457Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "InterSafe WebFilter", "vendor": "Alps System Integration Co., Ltd.", "versions": [{"status": "affected", "version": "prior to V9.1SP4 Build1653"}]}, {"product": "InterSafe LogDirector", "vendor": "Alps System Integration Co., Ltd.", "versions": [{"status": "affected", "version": "versions before the replacement file released on 2024 September 9"}]}, {"product": "InterSafe GatewayConnection", "vendor": "Alps System Integration Co., Ltd.", "versions": [{"status": "affected", "version": "versions before 2024 July 20 maintenance"}]}, {"product": "InterSafe LogNavigator", "vendor": "Alps System Integration Co., Ltd.", "versions": [{"status": "affected", "version": "prior to Ver.1.1.1"}]}, {"product": "InterSafe CATS", "vendor": "Alps System Integration Co., Ltd.", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}, {"product": "InterSafe MobileSecurity", "vendor": "Alps System Integration Co., Ltd.", "versions": [{"status": "affected", "version": "versions before 2024 August 31 maintenance"}]}, {"product": "InterScan WebManager", "vendor": "Trend Micro Incorporated", "versions": [{"status": "affected", "version": "9.0"}, {"status": "affected", "version": "9.0 Service Pack 1"}, {"status": "affected", "version": "9.1"}, {"status": "affected", "version": "9.1 Service Pack 1"}, {"status": "affected", "version": "9.1 Service Pack 2"}, {"status": "affected", "version": "9.1 Service Pack 3"}, {"status": "affected", "version": "and 9.1 Service Pack 4"}]}, {"product": "MJS WebFiltering", "vendor": "MIROKU JYOHO SERVICE CO., LTD.", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}, {"product": "AssetView F", "vendor": "Hammock Corporation", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}, {"product": "LANSCOPE EndpointManager WebFiltering", "vendor": "MOTEX Inc.", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}, {"product": "SPPM BizBrowser", "vendor": "AXSEED,Inc.", "versions": [{"status": "affected", "version": "versions before 2024 June 18 maintenance"}]}, {"product": "SPPM Secure Filtering", "vendor": "AXSEED,Inc.", "versions": [{"status": "affected", "version": "versions before 2024 July 20 maintenance"}]}, {"product": "URL Filtering", "vendor": "QualitySoft Corporation", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}, {"product": "KAITO SecureBrowser", "vendor": "JMA Systems Corporation", "versions": [{"status": "affected", "version": "versions before 2024 July 4 maintenance"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in."}, {"lang": "es", "value": "La vulnerabilidad de cross-site request forgery (CSRF) en varios productos de Alps System Integration y productos OEM permite que un atacante remoto no autenticado secuestre la autenticaci\u00f3n del usuario y realice operaciones no deseadas si el usuario ve una p\u00e1gina maliciosa mientras est\u00e1 conectado."}], "id": "CVE-2024-45504", "lastModified": "2026-06-17T07:54:19.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-45504", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T13:45:48.117386Z", "version": "2.0.3"}}]}, "published": "2024-09-10T05:15:12.780", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://alsifaq.dga.jp/faq_detail.html?id=6494"}, {"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN05579230/"}, {"source": "vultures@jpcert.or.jp", "url": "https://success.trendmicro.com/ja-JP/solution/KA-0017618"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.motex.co.jp/news/notice/2024/release240909/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}