CVE-2021-42641
HighCVSS 7.5Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
An IDOR vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an unauthenticated attacker to disclose usernames and email addresses of all users.
Risk Assessment
The risk involves potential mass leakage of personal data (usernames and email addresses), which can compromise user privacy and be exploited for social engineering attacks.
Recommendation
Immediately upgrade PrinterLogic Web Stack to a version later than 19.1.1.13 SP9 and implement access controls that verify permissions before disclosing data.
Other vulnerabilities in PrinterLogic Web Stack
See all- CVE-2021-42640Critical
An IDOR vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an unauthenticated attacker to reassign drivers for any printer.
- CVE-2021-42637Critical
An SSRF vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an attacker to use user-controlled input to craft a URL, enabling server-side requests to internal network resources.
- CVE-2021-42638High
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to pre-authentication remote code execution due to insufficient input sanitization.
- CVE-2021-42635High
The vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below is due to a hardcoded APP_KEY value. This allows pre-authentication remote code execution.
- CVE-2021-42631High
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserialize attacker-controlled data, leading to pre-authentication remote code execution.
- CVE-2021-42642High
An IDOR vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an unauthenticated attacker to disclose the plaintext console username and password for a printer.
- CVE-2021-42639Medium
Reflected XSS vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below. Attacker-controlled input is reflected back in the page without sanitization.
- CVE-2021-42633Medium
SQL Injection vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an attacker to inject malicious SQL code, potentially gaining unauthorized access to additional audit records.
Original NVD description (English source)
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the username and email address of all users.