CVE-2019-13170

Published: Mar 13, 2020Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device.

Affected (1)

Products: Xerox: Phaser 3320 Firmware

Xerox

1 product

Phaser 3320 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Phaser 3320 Firmware	Version v53.006.16.000

Running on/with	Platform Versions
Xerox Phaser 3320	All versions

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

https://security.business.xerox.com/

Source: cve@mitre.org

Vendor Advisory

https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/

Source: cve@mitre.org

Third Party Advisory

https://security.business.xerox.com/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.