CVE-2018-18006

Опубликовано: 14 дек. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers, and names of printed files.

Ссылки

http://packetstormsecurity.com/files/150399/Ricoh-myPrint-Hardcoded-Credentials-Information-Disclosure.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Nov/46
Exploit
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/150399/Ricoh-myPrint-Hardcoded-Credentials-Information-Disclosure.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Nov/46
Exploit
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ricoh:myprint:2.2.7:*:*:*:*:android:*:*

cpe:2.3:a:ricoh:myprint:2.9.2.4:*:*:*:*:windows:*:*

EPSS

Процентиль: 85%

0.02493

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-798

Связанные уязвимости

GHSA-mqxj-m3gw-p6fr