CVE-2022-42909

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-862

Affected software

Vendor	Product	Versions
WEPA	Wepa Print Away	not versioned

References

https://enrique.wtf/CVE-2022-42909Third Party Advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-awayThird Party Advisory
https://enrique.wtf/CVE-2022-42909Third Party Advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-awayThird Party Advisory

Timeline

Published: Feb 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-429110.0The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an CVE-2022-429158.1curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection CVE-2022-429167.5In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed t CVE-2022-429176.7In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/CVE-2022-429197.8Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python mu CVE-2022-42927.8Use After Free in GitHub repository vim/vim prior to 9.0.0882.CVE-2022-429209.8Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-b CVE-2022-429238.8Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allo CVE-2022-429246.5Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allo CVE-2022-429258.8There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to pri CVE-2022-429278.1A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.CVE-2022-429288.8Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corr