PT-2019-9415 · Printeron · Printeron Central Print Services

Drunkenshells · Publicado 2019-07-19 · Atualizado 2019-07-26 · CVE-2018-17210

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrinterOn Central Print Services versions through 4.1.4

Description An issue was discovered in the core components of PrinterOn Central Print Services that create and launch a print job, where they do not perform complete verification of the session cookie supplied to them. This allows an attacker with guest or pseudo-guest level permissions to bypass session checks by directly calling the core print job components via crafted HTTP GET and POST requests, which would otherwise log out a low-privileged user.

Recommendations For versions through 4.1.4, consider restricting access to the core print job components to prevent direct calls via crafted HTTP requests as a temporary workaround until a patch is available.

Exploit

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2018-17210

Produtos afetados

Printeron Central Print Services

Referências · 4

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17210-Authorization_Bypass-PrinterOn · Exploit
• https://t.me/cibsecurity/5742 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-17210 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17210 · Aviso do Fabricante