PT-2010-5302 · Hewlett Packard · Hp Laserjet Mfp+7

Moritz Jodeit · Published 2010-11-17 · Updated 2017-08-17 · CVE-2010-4107

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HP LaserJet MFP printers, Color LaserJet MFP printers, and LaserJet 4100, 4200, 4300, 5100, 8150, and 9000 printers (affected versions not specified)

Description The default configuration of the PJL Access value in the File System External Access settings enables PJL commands that use the device's filesystem. This allows remote attackers to read arbitrary files via a command inside a print job, as demonstrated by a directory traversal attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-4107

Affected Products

Color Laserjet Mfp

Hp Laserjet Mfp

Laserjet 4100

Hp Laserjet 4200

Hp Laserjet 4300

Laserjet 5100

Laserjet 8150

Laserjet 9000

References · 14

• 🔥 https://exploit-db.com/exploits/15631 · Exploit
• 🔥 http://exploit-db.com/exploits/15631 · Exploit
• 🔥 https://exploit-db.com/exploits/32990 · Exploit
• 🔥 https://exploit-db.com/exploits/17635 · Exploit
• 🔥 https://exploit-db.com/exploits/17636 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-4107 · Security Note
• http://vupen.com/english/advisories/2010/2987 · Vendor Advisory
• http://secunia.com/advisories/42238 · Vendor Advisory
• http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02004333 · Vendor Advisory
• http://securitytracker.com/id?1024741 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/63261 · Note
• http://securityfocus.com/bid/44882 · Note
• http://securityreason.com/securityalert/8328 · Note
• http://nruns.com/_downloads/SA-2010%20003-Hewlett-Packard.pdf · Note