Dell Laser Printer 2335dn and 2355dn Improper Neutralization of Input During Web Page Generation (CVE-2017-14386)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502385);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/16");

  script_cve_id("CVE-2017-14386");

  script_name(english:"Dell Laser Printer 2335dn and 2355dn Improper Neutralization of Input During Web Page Generation (CVE-2017-14386)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The web user interface of Dell 2335dn and 2355dn Multifunction Laser
Printers, firmware versions prior to V2.70.06.26 A13 and V2.70.45.34
A10 respectively, are affected by a cross-site scripting
vulnerability. Attackers could potentially exploit this vulnerability
to execute arbitrary HTML or JavaScript code in the user's browser
session in the context of the affected website.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # http://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=782W3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?11f24176");
  # http://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=CG55V
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4896619b");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-14386");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/12/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/12/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/09/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dell:2355dn_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dell:2335dn_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Dell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Dell');

var asset = tenable_ot::assets::get(vendor:'Dell');

var vuln_cpes = {
    "cpe:/o:dell:2335dn_firmware" :
        {"versionEndExcluding" : "2.70.06.26", "family" : "DellLaserPrinter"},
    "cpe:/o:dell:2355dn_firmware" :
        {"versionEndExcluding" : "2.70.45.34", "family" : "DellLaserPrinter"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);