CVE-2009-2684
published 2009-10-13CVE-2009-2684: Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP…
PriorityP421medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
2.23%
80.5th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SERVER HP LaserJet Printer Cross Site Scripting Attempt
suricata·2010-07-30
CVE-2009-2684 ET WEB_SERVER HP LaserJet Printer Cross Site Scripting Attempt
ET WEB_SERVER HP LaserJet Printer Cross Site Scripting Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER HP LaserJet Printer Cross Site Scripting Attempt"; flow:established,to_server; http.uri; content:"/support_param.html/config"; nocase; content:"Admin_Name=&Admin_Phone="; nocase; content:"Product_URL="; nocase; pcre:"/(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange).+Apply\x3DApply/i"; reference:url,dsecrg.com/pages/vul/show.php?id=148; reference:cve,2009-2684; classtype:web-application-attack; sid:2010919; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, cve CVE_2009_2684, deployment Datacenter, signature_severity Maj
Exploit-DB
HP LaserJet Printers - Multiple Persistent Cross-Site Scripting Vulnerabilities
exploitdb·2009-10-07·CVSS 4.3
CVE-2009-2684 [MEDIUM] HP LaserJet Printers - Multiple Persistent Cross-Site Scripting Vulnerabilities
HP LaserJet Printers - Multiple Persistent Cross-Site Scripting Vulnerabilities
---
Digital Security Research Group [DSecRG] Advisory #DSECRG-09-048
http://dsecrg.ru/pages/vul/show.php?id=148
Application: HP LaserJet printer web interface
Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others
Vendor URL: http://www.hp.com/
Bug: Multiple Stored XSS Vulnerabilities
Exploits: YES
Reported: 07.04.2009
Vendor response: 08.04.2009
Date of Public Advisory: 07.10.2009
CVE-number: CVE-2009-2684
CVSS2 score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Author: s.svistunovich, a.polyakov
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)
Description
Multiple security vulnerabilities have been identified with certain HP LaserJet printers,
HP Color LaserJet printers and HP Digi
Exploit-DB
HP Multiple LaserJet Printer - Cross-Site Scripting
exploitdb·2009-07-04·CVSS 4.3
CVE-2009-2684 [MEDIUM] HP Multiple LaserJet Printer - Cross-Site Scripting
HP Multiple LaserJet Printer - Cross-Site Scripting
---
Digital Security Research Group [DSecRG] Advisory #DSECRG-09-048
http://dsecrg.ru/pages/vul/show.php?id=148
Application: HP LaserJet printer web interface
Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others
Vendor URL: http://www.hp.com/
Bug: Multiple Stored XSS Vulnerabilities
Exploits: YES
Reported: 07.04.2009
Vendor response: 08.04.2009
Date of Public Advisory: 07.10.2009
CVE-number: CVE-2009-2684
CVSS2 score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Author: s.svistunovich, a.polyakov
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)
Description
Multiple security vulnerabilities have been identified with certain HP LaserJet printers,
HP Color LaserJet printers and HP Digital Senders. The vulnerabil
No writeups or analysis indexed.
http://dsecrg.com/pages/vul/show.php?id=148http://marc.info/?l=bugtraq&m=125493484205823&w=2http://secunia.com/advisories/36969http://www.securityfocus.com/archive/1/507038/100/0/threadedhttp://www.securityfocus.com/bid/36613http://www.vupen.com/english/advisories/2009/2850https://exchange.xforce.ibmcloud.com/vulnerabilities/53677http://dsecrg.com/pages/vul/show.php?id=148http://marc.info/?l=bugtraq&m=125493484205823&w=2http://secunia.com/advisories/36969http://www.securityfocus.com/archive/1/507038/100/0/threadedhttp://www.securityfocus.com/bid/36613http://www.vupen.com/english/advisories/2009/2850https://exchange.xforce.ibmcloud.com/vulnerabilities/53677
2009-10-13
Published