« Volver al listado

CVE-2018-17167

Estado: ModificadaMedia (5.4)—

PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Machine Host Name" or "Server Serial Number" field in the clustering configuration, (2) "name" field in the Edit Group configuration, (3) "Rule Name" field in the Access Control configuration, (4) "Service Name" in the Service Configuration, or (5) First Name or Last Name field in the Edit Account configuration.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Printeron — Printeron

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-17167",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-21T16:00:23.983",
  "references": [
    {
      "url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17167-XSS-PrinterON",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17167-XSS-PrinterON",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) \"Machine Host Name\" or \"Server Serial Number\" field in the clustering configuration, (2) \"name\" field in the Edit Group configuration, (3) \"Rule Name\" field in the Access Control configuration, (4) \"Service Name\" in the Service Configuration, or (5) First Name or Last Name field in the Edit Account configuration."
    },
    {
      "lang": "es",
      "value": "PrinterOn Enterprise 4.1.4 sufre de múltiples vulnerabilidades autenticadas de Cross-Site Scripting almacenado mediante (1) los campos \"Machine Host Name\" o \"Server Serial Number\" en la configuración de clústeres, (2) el campo \"name\" en la configuración de Edit Group, (3) el campo \"Rule Name\" en la configuración de Access Control, (4) \"Service Name\" en la configuración del servicio o (5) los campos \"First Name\" o \"Last Name\" en la configuración de Edit Account."
    }
  ],
  "lastModified": "2026-06-17T01:45:27.573",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:printeron:printeron:4.1.4:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF15BCEE-A69E-4C53-B995-17261A63EAA4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}