RICOH Streamline NX Operation History Tampering Vulnerability

A vulnerability exists in RICOH Streamline NX versions 3.5.1 to 24R3, allowing for unauthorized modification of operation history. This issue arises from the application directly recording usernames from HTTP request values. If an attacker can execute a man-in-the-middle attack, they could alter these request values, changing the usernames associated with specific operations in the management tool's history.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the operation history, potentially allowing users to impersonate others by altering recorded usernames.

Remediation

Users are advised to update to the latest version of RICOH Streamline NX. Additionally, enable HTTPS to ensure all communications are encrypted.