PT-2024-25724 · Sharp+1 · Multiple Mfps

Pierre Barre + 1 · Published 2024-11-26 · Updated 2024-11-26 · CVE-2024-34162

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions No specific product names, model numbers, or versions are mentioned in the provided descriptions.

Description The issue concerns the web interface of affected devices, which is designed to hide LDAP credentials from administrative users. However, when LDAP authentication is configured to "SIMPLE", the device communicates with the LDAP server in clear-text, allowing the LDAP password to be retrieved from this communication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-767

Related Identifiers

CVE-2024-34162

Affected Products

Multiple Mfps

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-34162 · Security Note
• http://seclists.org/fulldisclosure/2024/Jul/0 · Note
• https://toshibatec.com/information/20240531_02.html · Note
• https://toshibatec.co.jp/information/20240531_02.html · Note
• https://global.sharp/products/copier/info/info_security_2024-05.html · Note
• https://jvn.jp/en/vu/JVNVU93051062 · Note
• https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html · Note
• https://jp.sharp/business/print/information/info_security_2024-05.html · Note
• https://twitter.com/CVEnew/status/1861316559794286677 · Twitter Post