CVE-2009-2684
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1)…
Does this matter?
Lower severity and a low EPSS score (2.23%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.23% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- hp/cm8050 mfp · hp/cm8060 mfp · hp/color laserjet 3000n · hp/color laserjet 3600n · hp/color laserjet 3800n · hp/color laserjet 4700n · hp/color laserjet 4730 mfp · hp/color laserjet 6040 mfp · hp/color laserjet cm4730 mfp · hp/color laserjet cp3505 · hp/color laserjet cp4005n · hp/color laserjet cp6015 · hp/ds 9200c · hp/ds 9250c · hp/laserjet 2410 · hp/laserjet 2420 · hp/laserjet 2430n · hp/laserjet 4240 · hp/laserjet 4250n · hp/laserjet 4345 mfp · +15 more
- Source
- cve@mitre.org
References
- http://dsecrg.com/pages/vul/show.php?id=148Exploit
- http://marc.info/?l=bugtraq&m=125493484205823&w=2
- http://secunia.com/advisories/36969Vendor Advisory
- http://www.securityfocus.com/archive/1/507038/100/0/threaded
- http://www.securityfocus.com/bid/36613
- http://www.vupen.com/english/advisories/2009/2850Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53677
- http://dsecrg.com/pages/vul/show.php?id=148Exploit
- http://marc.info/?l=bugtraq&m=125493484205823&w=2
- http://secunia.com/advisories/36969Vendor Advisory
- http://www.securityfocus.com/archive/1/507038/100/0/threaded
- http://www.securityfocus.com/bid/36613
- http://www.vupen.com/english/advisories/2009/2850Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53677
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.