Multiple vulnerabilities in Canon Oce Colorwave 500 printer



Published: 2020-03-23
Risk Low
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2020-10671
CVE-2020-10670
CVE-2020-10668
CVE-2020-10667
CVE-2020-10669
CWE-ID CWE-352
CWE-79
CWE-287
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Oce Colorwave 500
Hardware solutions / Office equipment, IP-phones, print servers

Vendor Canon Inc.

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Cross-site request forgery

EUVDB-ID: #VU26303

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-10671

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the printer's web application. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oce Colorwave 500: 4.0.0.0

CPE2.3 External links

http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html
http://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Cross-site scripting

EUVDB-ID: #VU26302

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-10670

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "settingId" parameter in the "/SettingsEditor/settingDialogContent.jsp" page. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Oce Colorwave 500: 4.0.0.0

CPE2.3 External links

http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html
http://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

3) Cross-site scripting

EUVDB-ID: #VU26301

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-10668

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "openSI" parameter in "/home.jsp". A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Oce Colorwave 500: 4.0.0.0

CPE2.3 External links

http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html
http://seclists.org/fulldisclosure/2020/Mar/24
http://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

4) Stored cross-site scripting

EUVDB-ID: #VU26300

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-10667

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "map(template_name)" parameter in "/TemplateManager/indexExternalLocation.jsp". A remote attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oce Colorwave 500: 4.0.0.0

CPE2.3 External links

http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html
http://seclists.org/fulldisclosure/2020/Mar/24
http://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

5) Improper Authentication

EUVDB-ID: #VU26299

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-10669

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error on the "/home.jsp" page. A remote attacker on the local network able to connect to the device's web interface can bypass authentication process and get a copy of the documents uploaded by any users.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Oce Colorwave 500: 4.0.0.0

CPE2.3 External links

http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html
http://seclists.org/fulldisclosure/2020/Mar/24
http://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###