PT-2019-9401 · Printeron · Printeron Enterprise

Drunkenshells · Published 2019-04-18 · Updated 2019-04-19 · CVE-2018-17168

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PrinterOn Enterprise version 4.1.4

Description The issue allows an attacker to trick an administrator into making unwanted changes to a printer, such as disabling or approving it, by following a malicious link. This is due to multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page.

Recommendations For PrinterOn Enterprise version 4.1.4, consider restricting access to the Administration page until a fix is available. As a temporary workaround, administrators should be cautious when following links and avoid making changes to printer settings from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-17168

Affected Products

Printeron Enterprise

References · 3

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17168-CSRF-PrinterON · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17168 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17168 · Vendor Advisory