CVE-2024-1621

HIGH EPSS 28.2%
Published Sep 2, 20241y ago · Modified Jun 17, 20262w ago
8.3 CVSS 4.0
High
Find Similar
Published Sep 2, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on the tenant. Those tenants utilising email login in combination with Microsoft Safe Links or similar are impacted. This vulnerability may allow the attacker to register themselves against a genuine user in the system and allow malicious users with similar access and capabilities via the app to the existing genuine user.

CVSS Details

Base Score
8.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
28.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-940

Affected Products 6

VendorProductVersionRange
nt-wareuniflow_online* ≤2024.1.0
nt-wareuniflow_online*any
nt-wareuniflow_online_print_\&_scan*any
nt-wareuniflow_online_print_\&_scan*any
nt-wareuniflow_smartclient*any
nt-wareuniflow_smartclient*any

References 2

  • ntware.atlassian.net https://ntware.atlassian.net/wiki/spaces/SA/pages/12113215492/2024+Security+Advisory+Device+registration+susceptible+to+compromise
    Vendor Advisory
  • canon-europe.com https://www.canon-europe.com/psirt/advisory-information/
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.