Lucene search

[email protected]CVE-2019-10880

HistoryApr 12, 2019 - 6:29 p.m.

CVE-2019-10880

2019-04-1218:29:00

CWE-78

[email protected]

web.nvd.nist.gov

xerox

vulnerability

remote command execution

linux

os command injection

http interface

authentication

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

59.3%

JSON

Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the “nobody” user through a crafted “HTTP” request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.

CPENameOperatorVersion
xerox:colorqube_8700_firmwarexerox colorqube 8700 firmwarelt072.161.009.07200
xerox:colorqube_8900_firmwarexerox colorqube 8900 firmwarelt072.161.009.07200
xerox:colorqube_9301_firmwarexerox colorqube 9301 firmwarelt072.180.009.07200
xerox:colorqube_9302_firmwarexerox colorqube 9302 firmwarelt072.180.009.07200
xerox:colorqube_9303_firmwarexerox colorqube 9303 firmwarelt072.180.009.07200

CPE	Name	Operator	Version
xerox:colorqube_8700_firmware	xerox colorqube 8700 firmware	lt	072.161.009.07200
xerox:colorqube_8900_firmware	xerox colorqube 8900 firmware	lt	072.161.009.07200
xerox:colorqube_9301_firmware	xerox colorqube 9301 firmware	lt	072.180.009.07200
xerox:colorqube_9302_firmware	xerox colorqube 9302 firmware	lt	072.180.009.07200
xerox:colorqube_9303_firmware	xerox colorqube 9303 firmware	lt	072.180.009.07200

References

airbus-seclab.github.io/

securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdf

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

59.3%

JSON

Related for CVE-2019-10880

openvas1 cvelist1 prion1