PT-2018-11021 · Canon · Canon Printme Efi

Huy Kha · Publicado 2018-06-11 · Atualizado 2018-07-30 · CVE-2018-12111

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Canon PrintMe EFI (affected versions not specified)

Description A cross-site scripting (XSS) issue exists in the Canon PrintMe EFI web interface, allowing remote attackers to inject arbitrary web script or HTML via the PATH INFO to the "/wt3/mydocs.php" API endpoint. The PATH INFO variable is used to specify the path information for the request, and in this case, it is vulnerable to injection of malicious scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-12111

Produtos afetados

Canon Printme Efi

Referências · 3

• 🔥 https://exploit-db.com/exploits/44882 · Exploit
• https://gist.github.com/huykha/b16109b8e859a992b658dd18b2ee4a7c · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-12111 · Nota de Segurança