PT-2023-14161 · Wepa · Wepa Print Away

CVE-2022-42909 · Publicado 2023-02-03 · Atualizado 2023-02-10

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WEPA Print Away (affected versions not specified)

Description The issue arises from the lack of verification of user authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don't own and print them without authorization. To exploit this, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

XSS

Enumeração de Fraquezas

CWE-862

CWE-79

Identificadores relacionados

CVE-2022-42909

Produtos afetados

Wepa Print Away

Referências · 4

• https://t.me/cibsecurity/57504 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-42909 · Nota de Segurança
• https://incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-away · Nota
• https://enrique.wtf/CVE-2022-42909 · Nota