CVE-2009-2684

HP LaserJet Printers - Multiple Persistent Cross-Site Scripting Vulnerabilities

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.

Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Jetdirect y Embedded Web Server (EWS) sobre ciertas HP LaserJet e impresoras Color LaserJet, y HP Digital Senders, permiten a atacantes remotos inyectar código web o HTML a su elección a través de (1) Product_URL o (2)parámetro Tech_URL en una acción Apply en el código support_param.html/config.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-07-04 First Exploit
2009-08-05 CVE Reserved
2009-10-08 CVE Published
2024-01-16 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (9)

URL	Tag	Source
http://www.securityfocus.com/archive/1/507038/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/36613	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/53677	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/10011	2009-10-07
https://www.exploit-db.com/exploits/10055	2009-07-04
http://dsecrg.com/pages/vul/show.php?id=148	2024-08-07

URL	Date	SRC

URL	Date	SRC
http://marc.info/?l=bugtraq&m=125493484205823&w=2	2018-10-10
http://secunia.com/advisories/36969	2018-10-10
http://www.vupen.com/english/advisories/2009/2850	2018-10-10

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Hp Search vendor "Hp"		Cm8050 Mfp Search vendor "Hp" for product "Cm8050 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Cm8060 Mfp Search vendor "Hp" for product "Cm8060 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Color Laserjet 3000n Search vendor "Hp" for product "Color Laserjet 3000n"				*		-		Affected
Hp Search vendor "Hp"		Color Laserjet 3600n Search vendor "Hp" for product "Color Laserjet 3600n"				*		-		Affected
Hp Search vendor "Hp"		Color Laserjet 3800n Search vendor "Hp" for product "Color Laserjet 3800n"				*		-		Affected
Hp Search vendor "Hp"		Color Laserjet 4700n Search vendor "Hp" for product "Color Laserjet 4700n"				*		-		Affected
Hp Search vendor "Hp"		Color Laserjet 4730 Mfp Search vendor "Hp" for product "Color Laserjet 4730 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Color Laserjet 6040 Mfp Search vendor "Hp" for product "Color Laserjet 6040 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Color Laserjet Cm4730 Mfp Search vendor "Hp" for product "Color Laserjet Cm4730 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Color Laserjet Cp3505 Search vendor "Hp" for product "Color Laserjet Cp3505"				*		-		Affected
Hp Search vendor "Hp"		Color Laserjet Cp4005n Search vendor "Hp" for product "Color Laserjet Cp4005n"				*		-		Affected
Hp Search vendor "Hp"		Color Laserjet Cp6015 Search vendor "Hp" for product "Color Laserjet Cp6015"				*		-		Affected
Hp Search vendor "Hp"		Ds 9200c Search vendor "Hp" for product "Ds 9200c"				*		-		Affected
Hp Search vendor "Hp"		Ds 9250c Search vendor "Hp" for product "Ds 9250c"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 2410 Search vendor "Hp" for product "Laserjet 2410"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 2420 Search vendor "Hp" for product "Laserjet 2420"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 2430n Search vendor "Hp" for product "Laserjet 2430n"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 4240 Search vendor "Hp" for product "Laserjet 4240"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 4250n Search vendor "Hp" for product "Laserjet 4250n"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 4345 Mfp Search vendor "Hp" for product "Laserjet 4345 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 4350n Search vendor "Hp" for product "Laserjet 4350n"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 5200n Search vendor "Hp" for product "Laserjet 5200n"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 9040 Mfp Search vendor "Hp" for product "Laserjet 9040 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 9040n Search vendor "Hp" for product "Laserjet 9040n"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 9050 Mfp Search vendor "Hp" for product "Laserjet 9050 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Laserjet 9050n Search vendor "Hp" for product "Laserjet 9050n"				*		-		Affected
Hp Search vendor "Hp"		Laserjet M3027 Mfp Search vendor "Hp" for product "Laserjet M3027 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Laserjet M3035 Mfp Search vendor "Hp" for product "Laserjet M3035 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Laserjet M4345x Mfp Search vendor "Hp" for product "Laserjet M4345x Mfp"				*		-		Affected
Hp Search vendor "Hp"		Laserjet M5025 Mfp Search vendor "Hp" for product "Laserjet M5025 Mfp"				*		-		Affected
Hp Search vendor "Hp"		Laserjet M9040 Mpf Search vendor "Hp" for product "Laserjet M9040 Mpf"				*		-		Affected
Hp Search vendor "Hp"		Laserjet M9050 Mpf Search vendor "Hp" for product "Laserjet M9050 Mpf"				*		-		Affected
Hp Search vendor "Hp"		Laserjet P3005n Search vendor "Hp" for product "Laserjet P3005n"				*		-		Affected
Hp Search vendor "Hp"		Laserjet P4014 Search vendor "Hp" for product "Laserjet P4014"				*		-		Affected
Hp Search vendor "Hp"		Laserjet P4515 Search vendor "Hp" for product "Laserjet P4515"				*		-		Affected