Vulnerability · Published Feb 3, 2023 · Assigned by INCIBE
CVE-2022-42909
Medium 6.5
In plain English
A medium-severity cross-site scripting in Wepa Print Away from WEPA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WEPA | Wepa Print Away | not versioned |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N