CVE-2009-2820

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2009-2820

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2009-2820.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2009-2820

Related

Published

2009-11-10T19:30:01Z

Modified

2024-06-30T12:00:03Z

Summary

[none]

Details

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

References

Affected packages

Debian:11 / cups

Package

Name: cups
Purl: pkg:deb/debian/cups?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.2-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / cups

Package

Name: cups
Purl: pkg:deb/debian/cups?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.2-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / cups

Package

Name: cups
Purl: pkg:deb/debian/cups?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.2-1

Ecosystem specific

{
    "urgency": "low"
}