PT-2019-13699 · Repetier · Repetier Server

Ryan Wincey · Published 2019-10-28 · Updated 2020-12-04 · CVE-2019-14450

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Repetier-Server versions 0.8 through 0.91

Description A directory traversal issue allows the creation of a user-controlled XML file at an unintended location. This can be combined with another issue to upload an "external command" configuration as a printer configuration, achieving remote code execution. The exploitation is dependent on a system reboot or service restart after the initial setup.

Recommendations For Repetier-Server versions 0.8 through 0.91, as a temporary workaround, consider restricting access to the RepetierServer.exe until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-14450

Affected Products

Repetier Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-14450 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14450 · Vendor Advisory
• https://t.me/defcon_news/63205 · Telegram Post
• https://t.me/rnetsec/13917 · Telegram Post
• https://repetier-server.com/knowledgebase/security-advisory · Note
• https://repetier-server.com/manuals/0.91/index.html · Note