CVE-2009-2684

CVSS V2 Medium 4.3 CVSS V3 None
Description
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.
Overview
  • CVE ID
  • CVE-2009-2684
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2009-10-13T10:30:00
  • Last Modified Date
  • 2018-10-10T19:41:38
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:h:hp:cm8050_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:cm8060_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:color_laserjet_3000n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:color_laserjet_3600n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:color_laserjet_3800n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:color_laserjet_4700n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:color_laserjet_4730_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:color_laserjet_6040_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:color_laserjet_cm4730_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:color_laserjet_cp3505:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:color_laserjet_cp4005n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:color_laserjet_cp6015:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:ds_9200c:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:ds_9250c:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_2410:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_2420:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_2430n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_4240:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_4250n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_4345_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_4350n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_5200n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_9040_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_9040n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_9050_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_9050n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_m3027_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_m3035_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_m4345x_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_m5025_mfp:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_m9040_mpf:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_m9050_mpf:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_p3005n:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_p4014:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:hp:laserjet_p4515:*:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://dsecrg.com/pages/vul/show.php?id=148 Exploit
http://secunia.com/advisories/36969 Vendor Advisory
http://www.securityfocus.com/bid/36613
http://www.vupen.com/english/advisories/2009/2850 Vendor Advisory
http://marc.info/?l=bugtraq&m=125493484205823&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/53677
http://www.securityfocus.com/archive/1/507038/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2009-2684
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2684
History
Created Old Value New Value Data Type Notes
2022-05-10 18:32:26 Added to TrackCVE