PT-2023-14161 · Wepa · Wepa Print Away

Published 2023-02-03 · Updated 2023-02-10 · CVE-2022-42909

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WEPA Print Away (affected versions not specified)

Description The issue arises from the lack of verification of user authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don't own and print them without authorization. To exploit this, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

XSS

Weakness Enumeration

CWE-862

CWE-79

Related Identifiers

CVE-2022-42909

Affected Products

Wepa Print Away

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-42909 · Security Note
• https://t.me/cibsecurity/57504 · Telegram Post
• https://incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-away · Note
• https://enrique.wtf/CVE-2022-42909 · Note