PT-2019-13700 · Repetier · Repetier Server

Ryan Wincey · Publicado 2019-10-25 · Atualizado 2019-10-28 · CVE-2019-14451

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Repetier-Server versions 0.8 through 0.91

Description The issue arises from improper validation of the XML data structure when uploading a new printer configuration. This can be exploited to achieve remote code execution by uploading an "external command" configuration as a printer configuration. The exploitation is dependent on combining this issue with another vulnerability. After successful exploitation, the loading of the external command configuration requires a system reboot or service restart.

Recommendations For Repetier-Server versions 0.8 through 0.91, update to a version that properly validates XML data structures to prevent remote code execution. As a temporary workaround, consider restricting the upload of new printer configurations until a patch is available.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-14451

Produtos afetados

Repetier Server

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-14451 · Aviso do Fabricante
• https://repetier-server.com/manuals/0.91/index.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14451 · Nota de Segurança
• https://repetier-server.com/knowledgebase/security-advisory · Aviso do Fabricante