CVE-2019-19363

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege escalation. Affected drivers and versions are: PCL6 Driver for Universal Print - Version 4.0 or later PS Driver for Universal Print - Version 4.0 or later PC FAX Generic Driver - All versions Generic PCL5 Driver - All versions RPCS Driver - All versions PostScript3 Driver - All versions PCL6 (PCL XL) Driver - All versions RPCS Raster Driver - All version

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN15697526/index.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/156082/Ricoh-Printer-Driver-Local-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/156251/Ricoh-Driver-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Jan/34Mailing List, Third Party Advisory
https://www.ricoh.com/info/2020/0122_1/Vendor Advisory
http://jvn.jp/en/jp/JVN15697526/index.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/156082/Ricoh-Printer-Driver-Local-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/156251/Ricoh-Driver-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Jan/34Mailing List, Third Party Advisory
https://www.ricoh.com/info/2020/0122_1/Vendor Advisory

Timeline

Published: Jan 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-193647.8A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019 CVE-2019-193666.1A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary CVE-2019-193676.1A cross-site scripting (XSS) vulnerability in app/fax/fax_files.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web scrip CVE-2019-193686.1A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by send CVE-2019-19379.8A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Ci CVE-2019-193706.1A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android cou CVE-2019-193716.1A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthentic CVE-2019-193727.5A downloadFile.php download_file path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders a CVE-2019-193737.5An issue was discovered in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3 CVE-2019-193749.1An issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc in Squiz M CVE-2019-193755.3In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secur CVE-2019-193766.5In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses inp