PT-2019-9404 · Xerox · Xerox C8030/C8035+3

Publicado 2019-01-03 · Atualizado 2019-10-03 · CVE-2018-17172

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xerox AltaLink B80xx versions prior to 100.008.028.05200 Xerox C8030/C8035 versions prior to 100.001.028.05200 Xerox C8045/C8055 versions prior to 100.002.028.05200 Xerox C8070 versions prior to 100.003.028.05200

Description The issue allows unauthenticated command injection in the web application.

Recommendations For Xerox AltaLink B80xx versions prior to 100.008.028.05200, update to version 100.008.028.05200 or later. For Xerox C8030/C8035 versions prior to 100.001.028.05200, update to version 100.001.028.05200 or later. For Xerox C8045/C8055 versions prior to 100.002.028.05200, update to version 100.002.028.05200 or later. For Xerox C8070 versions prior to 100.003.028.05200, update to version 100.003.028.05200 or later.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2018-17172

Produtos afetados

Xerox Altalink B80Xx

Xerox C8030/C8035

Xerox C8045/C8055

Xerox C8070

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-17172 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17172 · Aviso do Fabricante
• https://securitydocs.business.xerox.com/wp-content/uploads/2018/12/cert_Security_Mini_Bulletin_XRX18AL_for_ALB80xx-C80xx_v1.1.pdf · Aviso do Fabricante