CVE-2019-10880 - Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface)

Back Back to CVE browser

CRITICAL

Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface)

Published Apr 12, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 8.47%

Description

Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.

Affected products

Vendor Xerox Product ColorQube 8700/8900 Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <072.xxx.009.07200
Vendor Xerox Product n/a Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <072.xxx.009.07200

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Xerox

ColorQube 8700/8900

n/a

Version	Status	Constraints
unspecified	affected	<072.xxx.009.07200

Xerox

n/a

Version	Status	Constraints
unspecified	affected	<072.xxx.009.07200

Remediation

Vendor solution

A fix for some models is available.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://airbus-seclab.github.io/
x_refsource_MISCNot Applicable
https://securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdf
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://airbus-seclab.github.io/		x_refsource_MISCNot Applicable
https://securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdf		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner airbus

Published Apr 12, 2019

Updated Aug 4, 2024

Reserved Apr 5, 2019

Link CVE-2019-10880

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-10880

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-10880