{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4105", "assignerOrgId": "7168b535-132a-4efe-a076-338f829b2eb9", "state": "PUBLISHED", "assignerShortName": "YokogawaGroup", "dateReserved": "2024-04-23T23:06:00.203Z", "datePublished": "2024-06-26T05:25:04.524Z", "dateUpdated": "2024-08-01T20:33:52.203Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "FAST/TOOLS", "vendor": "Yokogawa Electric Corporation", "versions": [{"lessThanOrEqual": "R10.04", "status": "affected", "version": "R9.01", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "CI Server", "vendor": "Yokogawa Electric Corporation", "versions": [{"lessThanOrEqual": "R1.03.00", "status": "affected", "version": "R1.01.00", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product URL containing a malicious request, the malicious script may be executed on the client PC.<br>The affected products and versions are as follows:<br>FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04<br>CI Server R1.01.00 to R1.03.00"}], "value": "A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product URL containing a malicious request, the malicious script may be executed on the client PC.\nThe affected products and versions are as follows:\nFAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04\nCI Server R1.01.00 to R1.03.00"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7168b535-132a-4efe-a076-338f829b2eb9", "shortName": "YokogawaGroup", "dateUpdated": "2024-06-26T05:25:04.524Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-26T17:29:58.387431Z", "id": "CVE-2024-4105", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-26T17:30:23.193Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.203Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.203Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4105", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-26T17:29:58.387431Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-26T17:30:14.538Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Yokogawa Electric Corporation", "product": "FAST/TOOLS", "versions": [{"status": "affected", "version": "R9.01", "versionType": "custom", "lessThanOrEqual": "R10.04"}], "defaultStatus": "unknown"}, {"vendor": "Yokogawa Electric Corporation", "product": "CI Server", "versions": [{"status": "affected", "version": "R1.01.00", "versionType": "custom", "lessThanOrEqual": "R1.03.00"}], "defaultStatus": "unknown"}], "references": [{"url": "https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product URL containing a malicious request, the malicious script may be executed on the client PC.\nThe affected products and versions are as follows:\nFAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04\nCI Server R1.01.00 to R1.03.00", "supportingMedia": [{"type": "text/html", "value": "A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product URL containing a malicious request, the malicious script may be executed on the client PC.<br>The affected products and versions are as follows:<br>FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04<br>CI Server R1.01.00 to R1.03.00", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "7168b535-132a-4efe-a076-338f829b2eb9", "shortName": "YokogawaGroup", "dateUpdated": "2024-06-26T05:25:04.524Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4105", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:33:52.203Z", "dateReserved": "2024-04-23T23:06:00.203Z", "assignerOrgId": "7168b535-132a-4efe-a076-338f829b2eb9", "datePublished": "2024-06-26T05:25:04.524Z", "assignerShortName": "YokogawaGroup"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product URL containing a malicious request, the malicious script may be executed on the client PC.\nThe affected products and versions are as follows:\nFAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04\nCI Server R1.01.00 to R1.03.00"}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en FAST/TOOLS y CI Server. La funci\u00f3n del servidor WEB HMI del producto afectado para procesar solicitudes HTTP tiene un fallo de seguridad (XSS Reflejado) que permite la ejecuci\u00f3n de scripts maliciosos. Por lo tanto, si una PC cliente con medidas de seguridad inadecuadas accede a la URL de un producto que contiene una solicitud maliciosa, el script malicioso puede ejecutarse en la PC cliente. Los productos y versiones afectados son los siguientes: FAST/TOOLS (Paquetes: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 a R10.04 CI Server R1.01.00 a R1.03.00"}], "id": "CVE-2024-4105", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "7168b535-132a-4efe-a076-338f829b2eb9", "type": "Secondary"}]}, "published": "2024-06-26T06:15:15.500", "references": [{"source": "7168b535-132a-4efe-a076-338f829b2eb9", "url": "https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf"}], "sourceIdentifier": "7168b535-132a-4efe-a076-338f829b2eb9", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "7168b535-132a-4efe-a076-338f829b2eb9", "type": "Secondary"}]}

{}

{}