CVE-2008-5184

2008-11-2102:30:00

CWE-255

[email protected]

web.nvd.nist.gov

561

cups

web interface

csrf

cve-2008-5184

nvd

6.4 Medium

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.013 Low

EPSS

Percentile

85.5%

JSON

The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions.

CPENameOperatorVersion
apple:cupsapple cupseq1.1.20
apple:cupsapple cupseq1.1.5-2
apple:cupsapple cupseq1.1.14
apple:cupsapple cupseq1.3
apple:cupsapple cupseq1.1.6-1
apple:cupsapple cupseq1.1.18
apple:cupsapple cupseq1.1.12
apple:cupsapple cupsle1.3.7
apple:cupsapple cupseq1.1.5-1
apple:cupsapple cupseq1.3.3

CPE	Name	Operator	Version
apple:cups	apple cups	eq	1.1.20
apple:cups	apple cups	eq	1.1.5-2
apple:cups	apple cups	eq	1.1.14
apple:cups	apple cups	eq	1.3
apple:cups	apple cups	eq	1.1.6-1
apple:cups	apple cups	eq	1.1.18
apple:cups	apple cups	eq	1.1.12
apple:cups	apple cups	le	1.3.7
apple:cups	apple cups	eq	1.1.5-1
apple:cups	apple cups	eq	1.3.3