How severe is CVE-2022-42908?

CVE-2022-42908 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity high, and availability none.

Is CVE-2022-42908 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-42908?

CVE-2022-42908 affects Wepanow Print Away. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-42908?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-42908 published?

CVE-2022-42908 was published on 2023-02-03 and last updated on 2026-06-17.

CVE-2022-42908

CVE-2022-42908 is a medium-severity vulnerability in Wepanow Print Away with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-79.

Key facts

Severity: Medium (CVSS 3.x base score 6.3)
EPSS exploit prediction: 0% (29th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-79
Affected product: Wepanow Print Away
Published: 2023-02-03
Last modified: 2026-06-17

Description

WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persistent across victim sessions.

Frequently asked questions

What is CVE-2022-42908?: WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persistent across victim sessions.
How severe is CVE-2022-42908?: CVE-2022-42908 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity high, and availability none.
Is CVE-2022-42908 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-42908?: CVE-2022-42908 affects Wepanow Print Away. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-42908?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-42908 published?: CVE-2022-42908 was published on 2023-02-03 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:wepanow:print_away:-:*:*:*:*:*:*:*

More vulnerabilities in Wepanow Print Away

CVE-2022-42909 — Medium (CVSS 6.5): WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and…

All CVEs affecting Wepanow Print Away →

Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities

CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…

Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →