CVE-2024-47801

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-25 · updated 2026-06-17
Weakness: CWE-79

Description

Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.

Affected products

SHARP Bp-30C25 Firmware: all versions
SHARP Bp-30C25T Firmware: all versions
SHARP Bp-30C25Y Firmware: all versions
SHARP Bp-30C25Z Firmware: all versions
SHARP Bp-30M28 Firmware: all versions
SHARP Bp-30M28T Firmware: all versions
SHARP Bp-30M31 Firmware: all versions
SHARP Bp-30M31T Firmware: all versions
SHARP Bp-30M35 Firmware: all versions
SHARP Bp-30M35T Firmware: all versions
SHARP Bp-50C26 Firmware: all versions
SHARP Bp-50C31 Firmware: all versions
SHARP Bp-50C36 Firmware: all versions
SHARP Bp-50C45 Firmware: all versions
SHARP Bp-50C55 Firmware: all versions
SHARP Bp-50C65 Firmware: all versions
SHARP Bp-50M26 Firmware: all versions
SHARP Bp-50M31 Firmware: all versions
SHARP Bp-50M36 Firmware: all versions
SHARP Bp-50M45 Firmware: all versions
SHARP Bp-50M50 Firmware: all versions
SHARP Bp-50M55 Firmware: all versions
SHARP Bp-55C26 Firmware: all versions
SHARP Bp-60C31 Firmware: all versions
SHARP Bp-60C36 Firmware: all versions
SHARP Bp-60C45 Firmware: all versions
SHARP Bp-70C31 Firmware: all versions
SHARP Bp-70C36 Firmware: all versions
SHARP Bp-70C45 Firmware: all versions
SHARP Bp-70C55 Firmware: all versions

References

https://global.sharp/products/copier/info/info_security_2024-10.html
https://jvn.jp/en/vu/JVNVU95063136/
https://www.toshibatec.com/information/20241025_01.html

Get alerted when CVE-2024-47801 or the next vulnerability affects your stack