PT-2019-13699 · Repetier · Repetier Server

Ryan Wincey · Publicado 2019-10-28 · Atualizado 2020-12-04 · CVE-2019-14450

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Repetier-Server versions 0.8 through 0.91

Description A directory traversal issue allows the creation of a user-controlled XML file at an unintended location. This can be combined with another issue to upload an "external command" configuration as a printer configuration, achieving remote code execution. The exploitation is dependent on a system reboot or service restart after the initial setup.

Recommendations For Repetier-Server versions 0.8 through 0.91, as a temporary workaround, consider restricting access to the RepetierServer.exe until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-14450

Produtos afetados

Repetier Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-14450 · Nota de Segurança
• https://t.me/defcon_news/63205 · Publicação no Telegram
• https://t.me/rnetsec/13917 · Publicação no Telegram
• https://repetier-server.com/knowledgebase/security-advisory · Nota
• https://osv.dev/vulnerability/CVE-2019-14450 · Aviso do Fabricante
• https://repetier-server.com/manuals/0.91/index.html · Nota