Vulners
Lucene search
Oce Colorwave 500 CSRF / XSS / Authentication Bypass Vulnerabilities
| Reporter | Title | Published | Views | Family All 42 |
|---|---|---|---|---|
 | Unspecified Vulnerability in Canon Oce Colorwave 500 | 20 Mar 202000:00 | – | cnvd |
| Canon Oce Colorwave 500 CSRF Vulnerability | 20 Mar 202000:00 | – | cnvd |
| Canon Oce Colorwave 500 cross-site scripting vulnerability (CNVD-2020-18988) | 20 Mar 202000:00 | – | cnvd |
| Canon Oce Colorwave 500 Cross-Site Scripting Vulnerability (CNVD-2020-18989) | 20 Mar 202000:00 | – | cnvd |
| Canon Oce Colorwave 500 Cross-Site Scripting Vulnerability (CNVD-2020-18990) | 20 Mar 202000:00 | – | cnvd |
 | Canon Oce Colorwave Printer Cross Site Scripting (CVE-2020-10667) | 15 Jun 202000:00 | – | checkpoint_advisories |
 | CVE-2020-10667 | 19 Mar 202018:07 | – | cve |
| CVE-2020-10668 | 19 Mar 202018:09 | – | cve |
| CVE-2020-10669 | 19 Mar 202022:29 | – | cve |
| CVE-2020-10670 | 19 Mar 202018:10 | – | cve |
10
# Exploit Title: Océ Colorwave 500 printer: Multiple vulnerabilities
# Exploit Author: Giuseppe Calì, Marco Ortisi
# Authors blog: https://www.redtimmy.com
# Vendor Homepage: https://www.canon.com
# Software Link:
https://lfpp.csa.canon.com/tss/tss_product_detail.jsp?PRODUCT%3C%3Eprd_id=845524441910378&SKU%3C%3Esku_id=1689949372031068&FOLDER%3C%3Efolder_id=2534374302162637&bmUID=mpYkKHM
# Version: 4.0.0.0
# CVE: 2020-10667, 2020-10668, 2020-10669, 2020-10670, 2020-10671
We have recently registered five CVE(s) affecting the Oce Colorwave 500
printer.
CVE-2020-10669 is an authentication bypass allowing an attacker to
access
documents that have been uploaded to the printer. As the documents
remain stored
in the system even after they have been printed (depending on the
printer's
configuration), a malicious insider may be able to access documents
printed in
the past.
CVE-2020-10667 is a Stored XSS on the
“/TemplateManager/indexExternalLocation.jsp”
page.
CVE-2020-10668 and CVE-10670 are two Reflected XSS on pages “/home.jsp”
and
“/SettingsEditor/settingDialogContent.jsp”.
Finally CVE-10671 is a system-wide CSRF due to the absence of any form
of nonce
or countermeasure protecting against Cross Site Request Forgery.
More details and full story here:
https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/
# 0day.today [2020-03-22] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
20 Mar 2020 00:00Current
0.4Low risk
Vulners AI Score0.4
EPSS0.03463