CVE-2021-42633

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to access additional audit records.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://printerlogic.com	Product
https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints	Not Applicable
https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html	Third Party Advisory
https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite	Third Party Advisory
https://www.printerlogic.com/security-bulletin/	Vendor Advisory
https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite	Third Party Advisory
https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:printerlogic:web_stack::::::::
	cpe:2.3:a:printerlogic:web_stack:19.1.1.13:-::::::
	cpe:2.3:a:printerlogic:web_stack:19.1.1.13:sp2::::::
	cpe:2.3:a:printerlogic:web_stack:19.1.1.13:sp3-3::::::
	cpe:2.3:a:printerlogic:web_stack:19.1.1.13:sp9::::::

History

No history.

Information

Published : 2022-02-02 18:15

Updated : 2022-02-07 20:12

NVD link : CVE-2021-42633

Mitre link : CVE-2021-42633

CVE.ORG link : CVE-2021-42633

JSON object : View

Products Affected

printerlogic

web_stack

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2021-42633", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-02-02T18:15:07.410", "references": [{"url": "http://printerlogic.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.printerlogic.com/security-bulletin/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to access additional audit records."}, {"lang": "es", "value": "PrinterLogic Web Stack versiones 19.1.1.13 SP9 y anteriores, son vulnerables a una inyecci\u00f3n SQL, que puede permitir a un atacante acceder a registros de auditor\u00eda adicionales"}], "lastModified": "2022-02-07T20:12:18.857", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:printerlogic:web_stack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7412210-0463-4336-9FAD-E50061806186", "versionEndExcluding": "19.1.1.13"}, {"criteria": "cpe:2.3:a:printerlogic:web_stack:19.1.1.13:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1B7FE83-A6AC-4A16-B0DE-9D1C22AA40FD"}, {"criteria": "cpe:2.3:a:printerlogic:web_stack:19.1.1.13:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99309983-36D6-47CA-9CBC-32A210C7DF7D"}, {"criteria": "cpe:2.3:a:printerlogic:web_stack:19.1.1.13:sp3-3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBD47013-B42E-4CF1-AF63-AD644B77DFBD"}, {"criteria": "cpe:2.3:a:printerlogic:web_stack:19.1.1.13:sp9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60152B10-DC40-4132-AF45-52ECFD6782CA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}