Details of VAR-202003-0920

ID

VAR-202003-0920

CVE

CVE-2019-13170

TITLE

plural Xerox Cross-site request forgery vulnerability in printers

Trust: 0.8

sources: JVNDB: JVNDB-2019-014911

DESCRIPTION

Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device. plural Xerox A cross-site request forgery vulnerability exists in the printer.Information may be tampered with. Fuji Xerox Corporation is the world's largest manufacturer of digital and information technology products and a global top 500 company. Fuji Xerox series printer products can meet various business needs. All kinds of black and white color digital printers have high performance and high quality. Fuji Xerox printers have a CSRF vulnerability that an attacker can use to execute arbitrary code on the device

Trust: 2.16

sources: NVD: CVE-2019-13170 // JVNDB: JVNDB-2019-014911 // CNVD: CNVD-2020-19215

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-19215

AFFECTED PRODUCTS

vendor:	xerox	model:	phaser 3320	scope:	eq	version:	v53.006.16.000	Trust: 1.0
vendor:	xerox	model:	phaser 3320	scope:	-	version:	-	Trust: 0.8
vendor:	fuji	model:	xerox phaser	scope:	eq	version:	3320v53.006.16.000	Trust: 0.6

sources: CNVD: CNVD-2020-19215 // JVNDB: JVNDB-2019-014911 // NVD: CVE-2019-13170

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-13170
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2019-014911
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-19215
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202003-853
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2019-13170
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2019-014911
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-19215
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-13170
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	JVNDB-2019-014911
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-19215 // JVNDB: JVNDB-2019-014911 // CNNVD: CNNVD-202003-853 // NVD: CVE-2019-13170

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.8

sources: JVNDB: JVNDB-2019-014911 // NVD: CVE-2019-13170

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202003-853

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-202003-853

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-014911

PATCH

title:	Xerox Security Information, Bulletins and Advisory Responses	url:	https://security.business.xerox.com/	Trust: 0.8
title:	Mini Bulletin XRX19R	url:	https://securitydocs.business.xerox.com/wp-content/uploads/2019/08/cert_Security_Mini_Bulletin_XRX19R_for_P3320.pdf	Trust: 0.8
title:	Patch for Fuji Xerox printers CSRF vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/210735	Trust: 0.6
title:	Xerox Phaser 3320 Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=112523	Trust: 0.6

sources: CNVD: CNVD-2020-19215 // JVNDB: JVNDB-2019-014911 // CNNVD: CNNVD-202003-853

EXTERNAL IDS

db:	NVD	id:	CVE-2019-13170	Trust: 3.0
db:	JVNDB	id:	JVNDB-2019-014911	Trust: 0.8
db:	CNVD	id:	CNVD-2020-19215	Trust: 0.6
db:	CNNVD	id:	CNNVD-202003-853	Trust: 0.6

sources: CNVD: CNVD-2020-19215 // JVNDB: JVNDB-2019-014911 // CNNVD: CNNVD-202003-853 // NVD: CVE-2019-13170

REFERENCES

url:	https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/	Trust: 1.6
url:	https://security.business.xerox.com/	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-13170	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-13170	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2019-13169	Trust: 0.6

sources: CNVD: CNVD-2020-19215 // JVNDB: JVNDB-2019-014911 // CNNVD: CNNVD-202003-853 // NVD: CVE-2019-13170

SOURCES

db:	CNVD	id:	CNVD-2020-19215
db:	JVNDB	id:	JVNDB-2019-014911
db:	CNNVD	id:	CNNVD-202003-853
db:	NVD	id:	CVE-2019-13170

LAST UPDATE DATE

2024-11-23T21:59:26.948000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-19215	date:	2020-03-25T00:00:00
db:	JVNDB	id:	JVNDB-2019-014911	date:	2020-03-27T00:00:00
db:	CNNVD	id:	CNNVD-202003-853	date:	2021-01-05T00:00:00
db:	NVD	id:	CVE-2019-13170	date:	2024-11-21T04:24:20.923

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-19215	date:	2020-03-25T00:00:00
db:	JVNDB	id:	JVNDB-2019-014911	date:	2020-03-27T00:00:00
db:	CNNVD	id:	CNNVD-202003-853	date:	2020-03-13T00:00:00
db:	NVD	id:	CVE-2019-13170	date:	2020-03-13T19:15:14.993