Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "

Summary

Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.

Timeline

1. Apr 12, 2019, 5:37 PM UTCCVE published
2. Aug 4, 2024, 10:32 PM UTCRecord last updated

Affected versions

• XEROX AltaLink B8045/B8055/B8065/B8075/B8090

  Version range not reported

• XEROX AltaLink C8030/C8035/C8045/C8055/C8070

  Version range not reported

• XEROX WorkCentre 3655

  Version range not reported

• XEROX WorkCentre 5845/5855/5865/5875/5890

  Version range not reported

• XEROX WorkCentre 5945/5955

  Version range not reported

• XEROX WorkCentre 6655

  Version range not reported

• XEROX WorkCentre 7220/7225

  Version range not reported

• XEROX WorkCentre 7830/7835/7845/7855

  Version range not reported

• XEROX WorkCentre 7970

  Version range not reported

• XEROX WorkCentre EC7836/EC7856

  Version range not reported

• XEROX ColorQube 9301/9302/9303

  fixed in 072.xxx.009.07200

• XEROX ColorQube 8700/8900

  fixed in 072.xxx.009.07200

• XEROX WorkCentre 6400

  Version range not reported

• XEROX Phaser 6700

  Version range not reported

• XEROX Phaser 7800

  Version range not reported

• XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790

  Version range not reported

• XEROX WorkCentre 7525/7530/7535/7545/7556

  Version range not reported

• XEROX WorkCentre 7755/7765/7775

  Version range not reported

References 2