RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. When this is combined with CVE-2019-14450, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-10-25T16:27:22

Updated: 2024-08-05T00:19:41.075Z

Reserved: 2019-07-30T00:00:00

Link: CVE-2019-14451

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-10-25T17:15:10.837

Modified: 2024-11-21T04:26:46.080

Link: CVE-2019-14451

cve-icon Redhat

No data.