CVE-2009-2820

published 2009-11-10

CVE-2009-2820: The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML…

Priority P4 25 medium 4.3 CVSS 2.0

AV N AC M Au N C N I P A N

EXPLOIT

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Affected

123 ranges · showing 25

Vendor	Product	Version range	Fixed in
apple	cups	>= 0 < 1.4.2-1	1.4.2-1
apple	cups	>= 0 < 1.4.2-1	1.4.2-1
apple	cups	>= 0 < 1.4.2-1	1.4.2-1
apple	cups	>= 0 < 1.4.2-1	1.4.2-1
apple	mac_os_x	<= 10.6.1	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—

CVSS provenance

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

osv 4.3 MEDIUM

vendor_debian 4.3 LOW

vendor_redhat 4.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79