NVD

Id
50043  
Name
CVE-2009-2820  
Description
The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product"s web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-11-10  
Modified Date
2010-08-21  
Seq
2009-2820  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
253193 50043 CVE-2009-2820 APPLE-SA-2009-11-09-1  View
253194 50043 CVE-2009-2820 oval:org.mitre.oval:def:9153  View
253195 50043 CVE-2009-2820 1021115  View
253196 50043 CVE-2009-2820 http://support.apple.com/kb/HT3937  View
253197 50043 CVE-2009-2820 http://www.cups.org/articles.php?L590  View
253198 50043 CVE-2009-2820 http://www.cups.org/documentation.php/relnotes.html  View
253199 50043 CVE-2009-2820 http://www.cups.org/str.php?L3367  View
253200 50043 CVE-2009-2820 MDVSA-2010:072  View
253201 50043 CVE-2009-2820 MDVSA-2010:073  View
253202 50043 CVE-2009-2820 RHSA-2009:1595  View
253203 50043 CVE-2009-2820 36956  View
253204 50043 CVE-2009-2820 ADV-2009-3184  View
253205 50043 CVE-2009-2820 https://bugzilla.redhat.com/show_bug.cgi?id=529833  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41320 JVNDB-2009-002327 Apple Mac OS X の CUPS におけるクロスサイトスクリプティングの脆弱性 Apple Mac OS X などで使用されている CUPS の Web インターフェースには、HTTP ヘッダおよび HTML テンプレートを適切に処理しないため、クロスサイトスクリプティング、および HTTP レスポンス分割攻撃実行される脆弱性が存在します。 CVE-2009-2820 40251 CVE-2009-2820 50043 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002327.html 2009-11-09 2010-08-12 View