Unscored severity · published Oct 13, 2009
CVE-2009-2684
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders,…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Cm8050 Mfp · HP
All versions, or not specified · source: NVD
CM
Cm8060 Mfp · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 3000n · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 3600n · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 3800n · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 4700n · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 4730 Mfp · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 6040 Mfp · HP
All versions, or not specified · source: NVD
CL
Color Laserjet Cm4730 Mfp · HP
All versions, or not specified · source: NVD
CL
Color Laserjet Cp3505 · HP
All versions, or not specified · source: NVD
CL
Color Laserjet Cp4005n · HP
All versions, or not specified · source: NVD
CL
Color Laserjet Cp6015 · HP
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2684
Exploit
http://dsecrg.com/pages/vul/show.php?id=148
marc.info
http://marc.info/?l=bugtraq&m=125493484205823&w=2
Vendor Advisory
http://secunia.com/advisories/36969
www.securityfocus.com
http://www.securityfocus.com/archive/1/507038/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/36613
Vendor Advisory
http://www.vupen.com/english/advisories/2009/2850