PT-2011-4872 · Hewlett Packard · Hp Managed Printing Administration

Andrea Micalizzi + 1 · Published 2011-12-22 · Updated 2019-10-09 · CVE-2011-4166

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HP Managed Printing Administration versions prior to 2.6.4

Description A directory traversal issue exists in the MPAUploader.Uploader.1.UploadFiles method, allowing remote attackers to create arbitrary files by submitting crafted form data.

Recommendations For versions prior to 2.6.4, update to version 2.6.4 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-4166

ZDI-11-352

Affected Products

Hp Managed Printing Administration

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_mpa_job_acct.rb · Exploit
• 🔥 https://exploit-db.com/exploits/27013 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4166 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-11-352 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03128469 · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-11-352 · Note