JVN#34328023: FUJIFILM Business Innovation Corp. printers vulnerable to cross-site request forgery

Multiple printers provided by FUJIFILM Business Innovation Corp. contain a cross-site request forgery vulnerability (CWE-352).

Impact

If a user views a malicious page while logging in, the user information may be altered. In the case the user is an administrator, the settings such as the administrator’s ID, password, etc. may be altered.

Solution

Apply workarounds
The developer states that there are some obsolite models where CSRF prevention function is not implemented.
For those models, applying the following workaround may mitigate the impact of this vulnerability.

• Disable Web UI communication function in the product’s settings

Products Affected

As for the details of affected product names, model numbers, and versions, refer to the information provided by the vendor listed below.

• FUJIFILM Business Inovation Corp.