Lucene search

MitreCVE-2009-2820

HistoryNov 10, 2009 - 7:30 p.m.

CVE-2009-2820

2009-11-1019:30:01

CWE-79

mitre

web.nvd.nist.gov

cups

web interface

xss attacks

http response splitting attacks

cve-2009-2820

security vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.8

Confidence

High

EPSS

0.009

Percentile

82.7%

JSON

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product’s web interface, (b) the configuration of the print system, and © the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Affected configurations

Nvd

Node

applemac_os_xRange≤10.6.1

applemac_os_xMatch10.0

applemac_os_xMatch10.0.0

applemac_os_xMatch10.0.1

applemac_os_xMatch10.0.2

applemac_os_xMatch10.0.3

applemac_os_xMatch10.0.4

applemac_os_xMatch10.1

applemac_os_xMatch10.1.0

applemac_os_xMatch10.1.1

applemac_os_xMatch10.1.2

applemac_os_xMatch10.1.3

applemac_os_xMatch10.1.4

applemac_os_xMatch10.1.5

applemac_os_xMatch10.2

applemac_os_xMatch10.2.0

applemac_os_xMatch10.2.1

applemac_os_xMatch10.2.2

applemac_os_xMatch10.2.3

applemac_os_xMatch10.2.4

applemac_os_xMatch10.2.5

applemac_os_xMatch10.2.6

applemac_os_xMatch10.2.7

applemac_os_xMatch10.2.8

applemac_os_xMatch10.3

applemac_os_xMatch10.3.0

applemac_os_xMatch10.3.1

applemac_os_xMatch10.3.2

applemac_os_xMatch10.3.3

applemac_os_xMatch10.3.4

applemac_os_xMatch10.3.5

applemac_os_xMatch10.3.6

applemac_os_xMatch10.3.7

applemac_os_xMatch10.3.8

applemac_os_xMatch10.3.9

applemac_os_xMatch10.4

applemac_os_xMatch10.4.0

applemac_os_xMatch10.4.1

applemac_os_xMatch10.4.2

applemac_os_xMatch10.4.3

applemac_os_xMatch10.4.4

applemac_os_xMatch10.4.5

applemac_os_xMatch10.4.6

applemac_os_xMatch10.4.7

applemac_os_xMatch10.4.8

applemac_os_xMatch10.4.9

applemac_os_xMatch10.4.10

applemac_os_xMatch10.4.11

applemac_os_xMatch10.5

applemac_os_xMatch10.5.0

applemac_os_xMatch10.5.1

applemac_os_xMatch10.5.2

applemac_os_xMatch10.5.3

applemac_os_xMatch10.5.4

applemac_os_xMatch10.5.5

applemac_os_xMatch10.5.6

applemac_os_xMatch10.5.7

applemac_os_xMatch10.5.8

applemac_os_xMatch10.6

Node

applemac_os_x_serverRange≤10.6.1

applemac_os_x_serverMatch10.0

applemac_os_x_serverMatch10.0.0

applemac_os_x_serverMatch10.0.1

applemac_os_x_serverMatch10.0.2

applemac_os_x_serverMatch10.0.3

applemac_os_x_serverMatch10.0.4

applemac_os_x_serverMatch10.1

applemac_os_x_serverMatch10.1.0

applemac_os_x_serverMatch10.1.1

applemac_os_x_serverMatch10.1.2

applemac_os_x_serverMatch10.1.3

applemac_os_x_serverMatch10.1.4

applemac_os_x_serverMatch10.1.5

applemac_os_x_serverMatch10.2

applemac_os_x_serverMatch10.2.0

applemac_os_x_serverMatch10.2.1

applemac_os_x_serverMatch10.2.2

applemac_os_x_serverMatch10.2.3

applemac_os_x_serverMatch10.2.4

applemac_os_x_serverMatch10.2.5

applemac_os_x_serverMatch10.2.6

applemac_os_x_serverMatch10.2.7

applemac_os_x_serverMatch10.2.8

applemac_os_x_serverMatch10.3

applemac_os_x_serverMatch10.3.0

applemac_os_x_serverMatch10.3.1

applemac_os_x_serverMatch10.3.2

applemac_os_x_serverMatch10.3.3

applemac_os_x_serverMatch10.3.4

applemac_os_x_serverMatch10.3.5

applemac_os_x_serverMatch10.3.6

applemac_os_x_serverMatch10.3.7

applemac_os_x_serverMatch10.3.8

applemac_os_x_serverMatch10.3.9

applemac_os_x_serverMatch10.4

applemac_os_x_serverMatch10.4.0

applemac_os_x_serverMatch10.4.1

applemac_os_x_serverMatch10.4.2

applemac_os_x_serverMatch10.4.3

applemac_os_x_serverMatch10.4.4

applemac_os_x_serverMatch10.4.5

applemac_os_x_serverMatch10.4.6

applemac_os_x_serverMatch10.4.7

applemac_os_x_serverMatch10.4.8

applemac_os_x_serverMatch10.4.9

applemac_os_x_serverMatch10.4.10

applemac_os_x_serverMatch10.4.11

applemac_os_x_serverMatch10.5

applemac_os_x_serverMatch10.5.0

applemac_os_x_serverMatch10.5.1

applemac_os_x_serverMatch10.5.2

applemac_os_x_serverMatch10.5.3

applemac_os_x_serverMatch10.5.4

applemac_os_x_serverMatch10.5.5

applemac_os_x_serverMatch10.5.6

applemac_os_x_serverMatch10.5.7

applemac_os_x_serverMatch10.5.8

applemac_os_x_serverMatch10.6

VendorProductVersionCPE
applemac_os_x10.0.0cpe:/o:apple:mac_os_x:10.0.0:::
applemac_os_x10.3.5cpe:/o:apple:mac_os_x:10.3.5:::
applemac_os_x10.4.4cpe:/o:apple:mac_os_x:10.4.4:::
applemac_os_x10.1.4cpe:/o:apple:mac_os_x:10.1.4:::
applemac_os_x10.3cpe:/o:apple:mac_os_x:10.3:::
applemac_os_x10.2.8cpe:/o:apple:mac_os_x:10.2.8:::
applemac_os_x10.4.7cpe:/o:apple:mac_os_x:10.4.7:::
applemac_os_x10.5.7cpe:/o:apple:mac_os_x:10.5.7:::
applemac_os_x10.1.3cpe:/o:apple:mac_os_x:10.1.3:::
applemac_os_x10.4.2cpe:/o:apple:mac_os_x:10.4.2:::

Vendor	Product	Version	CPE
apple	mac_os_x	10.0.0	cpe:/o:apple:mac_os_x:10.0.0:::
apple	mac_os_x	10.3.5	cpe:/o:apple:mac_os_x:10.3.5:::
apple	mac_os_x	10.4.4	cpe:/o:apple:mac_os_x:10.4.4:::
apple	mac_os_x	10.1.4	cpe:/o:apple:mac_os_x:10.1.4:::
apple	mac_os_x	10.3	cpe:/o:apple:mac_os_x:10.3:::
apple	mac_os_x	10.2.8	cpe:/o:apple:mac_os_x:10.2.8:::
apple	mac_os_x	10.4.7	cpe:/o:apple:mac_os_x:10.4.7:::
apple	mac_os_x	10.5.7	cpe:/o:apple:mac_os_x:10.5.7:::
apple	mac_os_x	10.1.3	cpe:/o:apple:mac_os_x:10.1.3:::
apple	mac_os_x	10.4.2	cpe:/o:apple:mac_os_x:10.4.2:::