CVE-2024-48870

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Toshiba Tec Corporation	e-STUDIO 908	T2.12.h3.00 and earlier versions
Toshiba Tec Corporation	e-STUDIO 1058	T1.01.h4.00 and earlier versions
Toshiba Tec Corporation	e-STUDIO 1208	T1.01.h4.00 and earlier versions
Sharp Corporation	Sharp Digital Full-color MFPs and Monochrome MFPs	see the information provided by Sharp Corporation

References

https://global.sharp/products/copier/info/info_security_2024-10.htmlVendor Advisory
https://jvn.jp/en/vu/JVNVU95063136/Third Party Advisory
https://www.toshibatec.com/information/20241025_01.htmlVendor Advisory

Timeline

Published: Oct 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-488719.8The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that th CVE-2024-488724.8Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and upda CVE-2024-488735.5In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR Th CVE-2024-488749.8Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform CVE-2024-488755.5In the Linux kernel, the following vulnerability has been resolved: btrfs: don't take dev_replace rwsem on task already holding it Running CVE-2024-488765.5In the Linux kernel, the following vulnerability has been resolved: stackdepot: fix stack_depot_save_flags() in NMI context Per documentat CVE-2024-488777.8A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A speciall CVE-2024-488788.8Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report.CVE-2024-48888.1BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcrip CVE-2024-488815.5In the Linux kernel, the following vulnerability has been resolved: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again Commit 028dd CVE-2024-488827.5A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network p CVE-2024-488834.3An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200,