CVE-2024-28038

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

T

he web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

References

Link	Resource
https://global.sharp/products/copier/info/info_security_2024-05.html
https://jp.sharp/business/print/information/info_security_2024-05.html
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html
https://www.toshibatec.co.jp/information/20240531_02.html
https://www.toshibatec.com/information/20240531_02.html
http://seclists.org/fulldisclosure/2024/Jul/0

Configurations

No configuration.

History

04 Nov 2025, 18:16

Type	Values Removed	Values Added
Summary		(es) La interfaz web de los dispositivos afectados procesa incorrectamente un valor de cookie, lo que provoca un desbordamiento del búfer de pila. Más precisamente, si se proporciona una cadena de caracteres demasiado larga al parámetro MFPSESSIONID, se produce un desbordamiento del búfer de pila. En cuanto a los detalles de los nombres de los productos afectados, los números de modelo y las versiones, consulte la información proporcionada por los respectivos proveedores que se enumeran en [Referencias].
References		() http://seclists.org/fulldisclosure/2024/Jul/0 -

26 Nov 2024, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-26 08:15

Updated : 2025-11-04 18:16

NVD link : CVE-2024-28038

Mitre link : CVE-2024-28038

CVE.ORG link : CVE-2024-28038

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2024-28038", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}]}, "published": "2024-11-26T08:15:04.873", "references": [{"url": "https://global.sharp/products/copier/info/info_security_2024-05.html", "source": "[email protected]"}, {"url": "https://jp.sharp/business/print/information/info_security_2024-05.html", "source": "[email protected]"}, {"url": "https://jvn.jp/en/vu/JVNVU93051062/", "source": "[email protected]"}, {"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html", "source": "[email protected]"}, {"url": "https://www.toshibatec.co.jp/information/20240531_02.html", "source": "[email protected]"}, {"url": "https://www.toshibatec.com/information/20240531_02.html", "source": "[email protected]"}, {"url": "http://seclists.org/fulldisclosure/2024/Jul/0", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."}, {"lang": "es", "value": "La interfaz web de los dispositivos afectados procesa incorrectamente un valor de cookie, lo que provoca un desbordamiento del b\u00fafer de pila. M\u00e1s precisamente, si se proporciona una cadena de caracteres demasiado larga al par\u00e1metro MFPSESSIONID, se produce un desbordamiento del b\u00fafer de pila. En cuanto a los detalles de los nombres de los productos afectados, los n\u00fameros de modelo y las versiones, consulte la informaci\u00f3n proporcionada por los respectivos proveedores que se enumeran en [Referencias]."}], "lastModified": "2025-11-04T18:16:17.373", "sourceIdentifier": "[email protected]"}