PT-2017-13090 · Lexmark · Lexmark Scan To Network

Publicado 2017-09-07 · Atualizado 2021-07-20 · CVE-2017-13771

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lexmark Scan To Network (SNF) versions 3.2.9 and earlier

Description The issue allows remote attackers to obtain sensitive information. This is due to network configuration credentials being stored in plaintext and transmitted in requests. Specifically, requests to "cgi-bin/direct/printer/prtappauth/apps/snfDestServlet" or "cgi-bin/direct/printer/prtappauth/apps/ImportExportServlet" are affected.

Recommendations For Lexmark Scan To Network (SNF) versions 3.2.9 and earlier, consider restricting access to the affected API endpoints "cgi-bin/direct/printer/prtappauth/apps/snfDestServlet" and "cgi-bin/direct/printer/prtappauth/apps/ImportExportServlet" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2017-13771

Produtos afetados

Lexmark Scan To Network

Referências · 5

• 🔥 http://packetstormsecurity.com/files/143975/Lexmark-Scan-To-Network-SNF-3.2.9-Information-Disclosure.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2017/Aug/46 · Exploit
• https://support.lexmark.com/alerts · Nota
• https://osv.dev/vulnerability/CVE-2017-13771 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-13771 · Nota de Segurança