CVE-2024-45504

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hijack the authentication of the user and to perform unintended operations if the user views a malicious page while logged in.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Alps System Integration Co., Ltd.	InterSafe WebFilter	prior to V9.1SP4 Build1653
Alps System Integration Co., Ltd.	InterSafe LogDirector	versions before the replacement file released on 2024 September 9
Alps System Integration Co., Ltd.	InterSafe GatewayConnection	versions before 2024 July 20 maintenance
Alps System Integration Co., Ltd.	InterSafe LogNavigator	prior to Ver.1.1.1
Alps System Integration Co., Ltd.	InterSafe CATS	versions before 2024 July 4 maintenance
Alps System Integration Co., Ltd.	InterSafe MobileSecurity	versions before 2024 August 31 maintenance
Trend Micro Incorporated	InterScan WebManager	9.0; 9.0 Service Pack 1; 9.1; 9.1 Service Pack 1; 9.1 Service Pack 2; 9.1 Service Pack 3; and 9.1 Service Pack 4
MIROKU JYOHO SERVICE CO., LTD.	MJS WebFiltering	versions before 2024 July 4 maintenance
Hammock Corporation	AssetView F	versions before 2024 July 4 maintenance
MOTEX Inc.	LANSCOPE EndpointManager WebFiltering	versions before 2024 July 4 maintenance
AXSEED,Inc.	SPPM BizBrowser	versions before 2024 June 18 maintenance
AXSEED,Inc.	SPPM Secure Filtering	versions before 2024 July 20 maintenance
QualitySoft Corporation	URL Filtering	versions before 2024 July 4 maintenance
JMA Systems Corporation	KAITO SecureBrowser	versions before 2024 July 4 maintenance

References

Timeline

Published: Sep 10, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-455058.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vu CVE-2024-455067.5HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwardin CVE-2024-455079.8Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue aff CVE-2024-455089.8HTMLDOC before 1.9.19 has an out-of-bounds write in parse_paragraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a w CVE-2024-455096.5In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the us CVE-2024-45518.8The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions u CVE-2024-455105.4An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scriptin CVE-2024-455115.4An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcas CVE-2024-455125.4An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerability by creating a fold CVE-2024-455134.8An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/CVE-2024-455145.4An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoin CVE-2024-455156.1An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due