PT-2010-5302 · Hewlett Packard · Hp Laserjet Mfp+7

Moritz Jodeit · Publicado 2010-11-17 · Atualizado 2017-08-17 · CVE-2010-4107

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HP LaserJet MFP printers, Color LaserJet MFP printers, and LaserJet 4100, 4200, 4300, 5100, 8150, and 9000 printers (affected versions not specified)

Description The default configuration of the PJL Access value in the File System External Access settings enables PJL commands that use the device's filesystem. This allows remote attackers to read arbitrary files via a command inside a print job, as demonstrated by a directory traversal attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-4107

Produtos afetados

Color Laserjet Mfp

Hp Laserjet Mfp

Laserjet 4100

Hp Laserjet 4200

Hp Laserjet 4300

Laserjet 5100

Laserjet 8150

Laserjet 9000

Referências · 14

• 🔥 https://exploit-db.com/exploits/15631 · Exploit
• 🔥 http://exploit-db.com/exploits/15631 · Exploit
• 🔥 https://exploit-db.com/exploits/32990 · Exploit
• 🔥 https://exploit-db.com/exploits/17635 · Exploit
• 🔥 https://exploit-db.com/exploits/17636 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-4107 · Nota de Segurança
• http://securitytracker.com/id?1024741 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/63261 · Nota
• http://vupen.com/english/advisories/2010/2987 · Aviso do Fabricante
• http://secunia.com/advisories/42238 · Aviso do Fabricante
• http://securityfocus.com/bid/44882 · Nota
• http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02004333 · Aviso do Fabricante
• http://securityreason.com/securityalert/8328 · Nota
• http://nruns.com/_downloads/SA-2010%20003-Hewlett-Packard.pdf · Nota