Cross-site scripting in Wepa Print Away
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-862.
Summary
WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WEPA | Wepa Print Away | not versioned | — | No fix listed | CNA |
- Wepa Print Away VendorWEPA Affected not versioned Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-42909
- 2026-10-03 Alias added: GHSA-6vvf-9qj9-6mw8
References
More Wepanow Print Away vulnerabilities
- TI-2022-20903 Cross-site scripting in Wepa Print Away CVSS 3.1MEDIUM 6.3
Sources
- CVE-2022-42909 · CVE Program
- CVE-2022-42909 · NVD
- FIRST EPSS
- GHSA-6vvf-9qj9-6mw8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences