A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of a user controlled XML file at an unintended location. When this is combined with CVE-2019-14451, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-10-28T16:58:41

Updated: 2024-08-05T00:19:40.999Z

Reserved: 2019-07-30T00:00:00

Link: CVE-2019-14450

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-10-28T17:15:19.877

Modified: 2024-11-21T04:26:45.937

Link: CVE-2019-14450

cve-icon Redhat

No data.