full-disclosure - [FD] Oce Colorwave 500 printer

Open Source and information security mailing list archives

Message-ID: <a0f6a40ec709af2dd9cfafc2a7199426@redtimmy.com>
Date: Thu, 19 Mar 2020 17:53:44 +0100
From: Red Timmy Security <publications@...timmy.com>
To: fulldisclosure@...lists.org
Subject: [FD] Oce Colorwave 500 printer - multiple vulnerabilities

Hi,
we have recently registered five CVE(s) affecting the Oce Colorwave 500 
printer.

CVE-2020-10669 is an authentication bypass allowing an attacker to 
access documents that have been uploaded to the printer. As the 
documents remain stored in the system even after they have been printed 
(depending on the printer's configuration), a malicious insider may be 
able to access documents printed in the past.

CVE-2020-10667 is a Stored XSS on the 
“/TemplateManager/indexExternalLocation.jsp” page.

CVE-2020-10668 and CVE-10670 are two Reflected XSS on pages “/home.jsp” 
and “/SettingsEditor/settingDialogContent.jsp”.

Finally CVE-10671 is a system-wide CSRF due to the absence of any form 
of nonce or countermeasure protecting against Cross Site Request 
Forgery.

More details and full story here: 
https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/

regards

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives