PT-2019-9415 · Printeron · Printeron Central Print Services

Drunkenshells · Published 2019-07-19 · Updated 2019-07-26 · CVE-2018-17210

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrinterOn Central Print Services versions through 4.1.4

Description An issue was discovered in the core components of PrinterOn Central Print Services that create and launch a print job, where they do not perform complete verification of the session cookie supplied to them. This allows an attacker with guest or pseudo-guest level permissions to bypass session checks by directly calling the core print job components via crafted HTTP GET and POST requests, which would otherwise log out a low-privileged user.

Recommendations For versions through 4.1.4, consider restricting access to the core print job components to prevent direct calls via crafted HTTP requests as a temporary workaround until a patch is available.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2018-17210

Affected Products

Printeron Central Print Services

References · 4

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17210-Authorization_Bypass-PrinterOn · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17210 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17210 · Vendor Advisory
• https://t.me/cibsecurity/5742 · Telegram Post