Published:2025/06/30  Last Updated:2025/06/30

JVN#24333956
SLNX Help Documentation of RICOH Streamline NX vulnerable to reflected cross-site scripting

Overview

SLNX Help Documentation of RICOH Streamline NX provided by Ricoh Company, Ltd. contains a reflected cross-site scripting vulnerability.

Products Affected

  • RICOH Streamline NX versions 3.5.0 to 3.7.2

Description

SLNX Help Documentation of RICOH Streamline NX provided by Ricoh Company, Ltd. contains the following vulnerability.

  • Reflected cross-site scripting via a specific parameter (CWE-79)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Base Score 5.1
    • CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score 6.1
    • CVE-2025-41439

Impact

An arbitrary script may be executed on the web browser of the user who accessed the product.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.
The developer has released the following version that addresses this vulnerability.

  • RICOH Streamline NX version 3.231.0 (=23R1) or later

Vendor Status

Vendor Link
Ricoh Company, Ltd. Notice on potential impact of "Cross-Site Scripting (XSS) Vulnerability in SLNX Help Documentation via specific Parameter" (CVE-2025-41439) towards RICOH Streamline NX V3

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Matteo Santini reported this vulnerability to Ricoh Company, Ltd. directly and coordinated. After the coordination, Ricoh Company, Ltd. reported this case to IPA under Information Security Early Warning Partnership, and JPCERT/CC coordinated with Ricoh Company, Ltd. for JVN publication.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2025-41439
JVN iPedia JVNDB-2025-000046