CVE-2022-42909 - WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes

Back Back to CVE browser

MEDIUM

WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes

Published Feb 3, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.

Affected products

Vendor WEPA Product Wepa Print Away Default
n/a
- Version
  not versioned
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

WEPA

Wepa Print Away

n/a

Version	Status	Constraints
not versioned	affected	-

Remediation

Vendor solution

The vulnerability has already been fixed by the WEPA security team.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-862

Missing Authorization

References (3)

https://enrique.wtf/CVE-2022-42909
Third Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45966
Advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-away
Third Party Advisory

Link	Providers	Tags
https://enrique.wtf/CVE-2022-42909		Third Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45966		Advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-away		Third Party Advisory