What is CVE-2022-42909?

CVE-2022-42909 is a medium-severity vulnerability in Wepa Print Away, classified under Cross-site Scripting. CVSS score: 6.5/10. Published 2023-02-03.

How severe is CVE-2022-42909?

Medium severity. CVSS v3 base score is 6.5 out of 10.

XSS in Wepa Print Away

CVE-2022-42909

WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (29.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Wepa Print Away — versions not versioned
Wepanow Print_away

Weakness classification (CWE)

References

cve-coordination@incibe.es (Third Party Advisory)
cve-coordination@incibe.es (Third Party Advisory)

Frequently asked questions

What is CVE-2022-42909?: CVE-2022-42909 is a medium-severity vulnerability in Wepa Print Away, classified under Cross-site Scripting. CVSS score: 6.5/10. Published 2023-02-03.
How severe is CVE-2022-42909?: Medium severity. CVSS v3 base score is 6.5 out of 10.