PT-2019-9401 · Printeron · Printeron Enterprise

Drunkenshells · Publicado 2019-04-18 · Atualizado 2019-04-19 · CVE-2018-17168

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PrinterOn Enterprise version 4.1.4

Description The issue allows an attacker to trick an administrator into making unwanted changes to a printer, such as disabling or approving it, by following a malicious link. This is due to multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page.

Recommendations For PrinterOn Enterprise version 4.1.4, consider restricting access to the Administration page until a fix is available. As a temporary workaround, administrators should be cautious when following links and avoid making changes to printer settings from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-17168

Produtos afetados

Printeron Enterprise

Referências · 3

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17168-CSRF-PrinterON · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17168 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17168 · Aviso do Fabricante