PT-2019-13700 · Repetier · Repetier Server

Ryan Wincey · Published 2019-10-25 · Updated 2019-10-28 · CVE-2019-14451

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Repetier-Server versions 0.8 through 0.91

Description The issue arises from improper validation of the XML data structure when uploading a new printer configuration. This can be exploited to achieve remote code execution by uploading an "external command" configuration as a printer configuration. The exploitation is dependent on combining this issue with another vulnerability. After successful exploitation, the loading of the external command configuration requires a system reboot or service restart.

Recommendations For Repetier-Server versions 0.8 through 0.91, update to a version that properly validates XML data structures to prevent remote code execution. As a temporary workaround, consider restricting the upload of new printer configurations until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-14451

Affected Products

Repetier Server

References · 4

• https://osv.dev/vulnerability/CVE-2019-14451 · Vendor Advisory
• https://repetier-server.com/manuals/0.91/index.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14451 · Security Note
• https://repetier-server.com/knowledgebase/security-advisory · Vendor Advisory