#Vendor: KYOCERA Corporation #Product https://global.kyocera.com #Affected version: 3.4.0906 # #Summary: KYOCERA Net Admin is Kyocera's unified #device management software that uses a web-based #platform to give network administrators easy and #uncomplicated control to handle a fleet for up to #10,000 devices. Tasks that used to require multiple #programs or walking to each printer can now be #accomplished in a single, fast and modern environment. # #Desc: The application interface allows users to perform #certain actions via HTTP requests without performing #any validity checks to verify the requests. This can #be exploited to perform certain actions with administrative #privileges if a logged-in user visits a malicious web #site. # #Tested on: Microsoft Windows 7 Professional SP1 (EN) #Apache Tomcat/8.5.15 # # #Vulnerability discovered by Gjoko 'LiquidWorm' Krstic #@zeroscience # # #Advisory ID: ZSL-2018-5458 #Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5458.php