NetSight
IP …
medium4.3Public exploit code

CVE-2009-2684

Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP D…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.

Affected products

VendorProductAffected versions
HpCm8050 Mfp
All versions
HpCm8060 Mfp
All versions
HpColor Laserjet 3000n
All versions
HpColor Laserjet 3600n
All versions
HpColor Laserjet 3800n
All versions
HpColor Laserjet 4700n
All versions
HpColor Laserjet 4730 Mfp
All versions
HpColor Laserjet 6040 Mfp
All versions
HpColor Laserjet Cm4730 Mfp
All versions
HpColor Laserjet Cp3505
All versions
HpColor Laserjet Cp4005n
All versions
HpColor Laserjet Cp6015
All versions

Weakness classification

CWE-79

References