CVE-2019-14450

critical · 9.8

A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of a user controlled XML file at an unintended location. When this is combined with CVE-2019-14451, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart.

9.8

CVSS

10.4%

EPSS (exploit prob.)

96th

EPSS percentile

2019-10-28

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
repetier-server	repetier-server	>= 0.80, <= 0.91

Check a specific version with /api/v1/cve/match.

References

https://www.repetier-server.com/knowledgebase/security-advisory/
https://www.repetier-server.com/manuals/0.91/index.html
https://www.repetier-server.com/knowledgebase/security-advisory/
https://www.repetier-server.com/manuals/0.91/index.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-14450