CVE-2022-42909

WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.

• CWE-79
• CWE-862

• https://enrique.wtf/CVE-2022-42909Third Party Advisory
• https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-awayThird Party Advisory
• https://enrique.wtf/CVE-2022-42909Third Party Advisory
• https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-awayThird Party Advisory

Published

Feb 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42902In Linaro Automated Validation Architecture (LAVA) before 20…8.8
• CVE-2022-42903Zoho ManageEngine SupportCenter Plus through 11024 allows lo…3.3
• CVE-2022-42904Zoho ManageEngine ADManager Plus through 7151 allows authent…7.2
• CVE-2022-42905In wolfSSL before 5.5.2, if callback functions are enabled (…9.1
• CVE-2022-42906powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 a…7.8
• CVE-2022-42908WEPA Print Away is vulnerable to a stored XSS. It does not p…5.4
• CVE-2022-4291The aswjsflt.dll library from Avast Antivirus windows contai…10
• CVE-2022-42915curl before 7.86.0 has a double free. If curl is told to use…8.1
• CVE-2022-42916In curl before 7.86.0, the HSTS check could be bypassed to t…7.5
• CVE-2022-42919Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux…7.8
• CVE-2022-4292Use After Free in GitHub repository vim/vim prior to 9.0.088…7.8
• CVE-2022-42920Apache Commons BCEL has a number of APIs that would normally…9.8