CVE-2024-27179: medium-severity vulnerability in Toshiba Tec e-Studio multi-function peripheral…
Session disclosure inside the log files
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.7epss 0.3%
In short
Admin login cookies are saved in plain text in log files, allowing attackers to steal them and gain unauthorized access to administrator accounts.
Technical detail
CWE-1295 involves storing sensitive authentication tokens in plaintext logs accessible to threat actors. An attacker with log file access can extract admin session cookies and use them to bypass authentication controls. This requires local or remote log access but enables complete account takeover of administrative accounts.
Summary generated and translated by AI from the official description.
Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Related CVEs — Toshiba Tec e-Studio multi-function peripheral…
In the same product, most dangerous first.