PT-2018-11021 · Canon · Canon Printme Efi

Huy Kha · Published 2018-06-11 · Updated 2018-07-30 · CVE-2018-12111

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Canon PrintMe EFI (affected versions not specified)

Description A cross-site scripting (XSS) issue exists in the Canon PrintMe EFI web interface, allowing remote attackers to inject arbitrary web script or HTML via the PATH INFO to the "/wt3/mydocs.php" API endpoint. The PATH INFO variable is used to specify the path information for the request, and in this case, it is vulnerable to injection of malicious scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-12111

Affected Products

Canon Printme Efi

References · 3

• 🔥 https://exploit-db.com/exploits/44882 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-12111 · Security Note
• https://gist.github.com/huykha/b16109b8e859a992b658dd18b2ee4a7c · Note