SB2023072713 - Multiple vulnerabilities in Kyocera Document Solutions Command Center RX (CCRX)

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Path traversal (CVE-ID: CVE-2023-34259)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

2) Path traversal (CVE-ID: CVE-2023-34260)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and perform a denial of service (DoS) attack.

3) Observable Response Discrepancy (CVE-ID: CVE-2023-34261)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the observable response discrepancy issue. A remote attacker can grasp if there is a login user name in data base for device at CCRX login

Remediation

Install update from vendor's website.

References

• https://jvn.jp/en/vu/JVNVU98785541/index.html
• https://www.kyoceradocumentsolutions.com/en/our-business/security/information/2023-07-14.html