CVE-2024-1621

Estado: AnalizadaAlta (8.3)—

The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on the tenant. Those tenants utilising email login in combination with Microsoft Safe Links or similar are impacted. This vulnerability may allow the attacker to register themselves against a genuine user in the system and allow malicious users with similar access and capabilities via the app to the existing genuine user.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 8.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.36%
Percentil entre todas las CVEs puntuadas: 28
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Nt-ware — Uniflow Online Nt-ware — Uniflow Online Print & Scan Nt-ware — Uniflow Smartclient

CWE

CWE-940
NVD-CWE-Other

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-1621",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-1621",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-03T13:57:32.174095Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
      "affectedData": [
        {
          "vendor": "NT-ware",
          "product": "uniFLOW Online",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2024.1.0 (including)"
            }
          ],
          "platforms": [
            "uniFLOW SmartClient",
            "Mobile Application",
            "Chrome Extension"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:nt-ware:uniflow_online:*:*:*:*:*:*:*:*"
          ],
          "vendor": "nt-ware",
          "product": "uniflow_online",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2024.1.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-02T20:15:03.223",
  "references": [
    {
      "url": "https://ntware.atlassian.net/wiki/spaces/SA/pages/12113215492/2024+Security+Advisory+Device+registration+susceptible+to+compromise",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3"
    },
    {
      "url": "https://www.canon-europe.com/psirt/advisory-information/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
      "description": [
        {
          "lang": "en",
          "value": "CWE-940"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on the tenant. Those tenants utilising email login in combination with Microsoft Safe Links or similar are impacted. This vulnerability may allow the attacker to register themselves against a genuine user in the system and allow malicious users with similar access and capabilities via the app to the existing genuine user."
    },
    {
      "lang": "es",
      "value": "El proceso de registro de las aplicaciones de uniFLOW Online (producto NT-ware), anteriores a la versión 2024.1.0 incluida, puede verse comprometido cuando el inicio de sesión por correo electrónico está habilitado en el inquilino. Los inquilinos que utilizan el inicio de sesión por correo electrónico en combinación con Microsoft Safe Links o similares se ven afectados. Esta vulnerabilidad puede permitir que el atacante se registre contra un usuario genuino en el sistema y permita que usuarios malintencionados con acceso y capacidades similares a través de la aplicación accedan al usuario genuino existente."
    }
  ],
  "lastModified": "2026-06-17T07:04:38.470",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nt-ware:uniflow_online:*:*:*:*:*:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B491AF6C-7381-45EF-9126-02084F35F2B9",
              "versionEndIncluding": "2024.1.0"
            },
            {
              "criteria": "cpe:2.3:a:nt-ware:uniflow_online:-:*:*:*:*:chrome:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC032FF5-116C-43D1-A0D2-ECBB1AA999F4"
            },
            {
              "criteria": "cpe:2.3:a:nt-ware:uniflow_online_print_\\&_scan:-:*:*:*:*:andriod:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB1B55B8-5C08-4901-834A-46B1AF8FB1F5"
            },
            {
              "criteria": "cpe:2.3:a:nt-ware:uniflow_online_print_\\&_scan:-:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98D679FD-54AC-4C3F-AB2E-8845EA30B916"
            },
            {
              "criteria": "cpe:2.3:a:nt-ware:uniflow_smartclient:-:*:*:*:*:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85135DB2-712B-4C65-8B2B-6B9D13E946F8"
            },
            {
              "criteria": "cpe:2.3:a:nt-ware:uniflow_smartclient:-:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF35091A-A1B5-431F-9C59-FBEC56768002"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3"
}