5.1

CVE-2009-0940

Exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hp ≫ 8100c Digital Sender Version -
Hp ≫ 9100c Digital Sender Version -
Hp ≫ 9200c Digital Sender Version -
Hp ≫ 9250c Digital Sender Version -
Hp ≫ Color Laserjet 4370mfp Version 20081211_46.211.2
Hp ≫ Color Laserjet 9500mfp Version 20070719_05.011.2
Hp ≫ Color Mfp Cm8050 Version - Update - Edition edgeline
Hp ≫ Color Mfp Cm8060 Version - Update - Edition edgeline
Hp ≫ Laserjet 2410 Version 20070410_08.112.3
Hp ≫ Laserjet 2420 Version 20070410_08.112.3
Hp ≫ Laserjet 2430 Version 20070410_08.112.3
Hp ≫ Laserjet 4250 Version 20080319_08.015.0
Hp ≫ Laserjet 4345mfp Version 20081211_09.131.1
Hp ≫ Laserjet 4350 Version 20080319_08.015.0
Hp ≫ Laserjet 5000 Version r.25.15
Hp ≫ Laserjet 5000 Version r.25.47
Hp ≫ Laserjet 5100 Version v.29.12
Hp ≫ Laserjet 9040 Version 20080204_08.110.0
Hp ≫ Laserjet 9040mfp Version 20080204_08.110.0
Hp ≫ Laserjet 9050 Version 20080204_08.110.0
Hp ≫ Laserjet 9050mfp Version 20080204_08.110.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.08% 0.608
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.1 4.9 6.4
AV:N/AC:H/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566
Vendor Advisory
http://osvdb.org/52847
http://osvdb.org/52848
http://osvdb.org/52849
http://www.louhinetworks.fi/advisory/HP_20090317.txt
Exploit
http://www.securityfocus.com/archive/1/501884/100/0/threaded
http://www.securityfocus.com/bid/34143
http://www.vupen.com/english/advisories/2009/0754