Cross site scripting

2009-11-1019:30:00

PRIOn knowledge base

www.prio-n.com

5.2 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.009 Low

EPSS

Percentile

82.2%

JSON

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product’s web interface, (b) the configuration of the print system, and © the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

CPENameOperatorVersion
mac_os_xeq10.5.8
mac_os_xeq10.4.3
mac_os_xeq10.2.5
mac_os_xeq10.2.7
mac_os_xeq10.0.2
mac_os_xeq10.2.8
mac_os_xeq10.2.1
mac_os_xeq10.5.6
mac_os_xeq10.3.1
mac_os_xeq10.3.5

Name	Operator	Version
mac_os_x	eq	10.5.8
mac_os_x	eq	10.4.3
mac_os_x	eq	10.2.5
mac_os_x	eq	10.2.7
mac_os_x	eq	10.0.2
mac_os_x	eq	10.2.8
mac_os_x	eq	10.2.1
mac_os_x	eq	10.5.6
mac_os_x	eq	10.3.1
mac_os_x	eq	10.3.5