CVE-2021-34086

Опубликовано: 10 янв. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests.

Ссылки

https://kth.diva-portal.org/smash/get/diva2:1623489/FULLTEXT01.pdf
Technical Description
Third Party Advisory
https://ultimaker.com/3d-printers/ultimaker-3
Product
Vendor Advisory
https://ultimaker.com/3d-printers/ultimaker-s3
Product
Vendor Advisory
https://ultimaker.com/3d-printers/ultimaker-s5
Product
Vendor Advisory
https://kth.diva-portal.org/smash/get/diva2:1623489/FULLTEXT01.pdf
Technical Description
Third Party Advisory
https://ultimaker.com/3d-printers/ultimaker-3
Product
Vendor Advisory
https://ultimaker.com/3d-printers/ultimaker-s3
Product
Vendor Advisory
https://ultimaker.com/3d-printers/ultimaker-s5
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:ultimaker:ultimaker_s3_firmware:*:*:*:*:*:*:*:*

Версия до 6.3 (включая)

cpe:2.3:h:ultimaker:ultimaker_s3:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:ultimaker:ultimaker_s5_firmware:*:*:*:*:*:*:*:*

Версия до 6.3 (включая)

cpe:2.3:h:ultimaker:ultimaker_s5:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:ultimaker:ultimaker_3_firmware:*:*:*:*:*:*:*:*

Версия до 5.2.16 (включая)

cpe:2.3:h:ultimaker:ultimaker_3:-:*:*:*:*:*:*:*

EPSS

Процентиль: 44%

0.00213

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-c7fj-697w-86j9

github

около 4 лет назад

EPSS

Процентиль: 44%

0.00213

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352