CVE-2009-2684

HP Printers - XSS

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.

Exploits (2)

exploitdb WRITEUP VERIFIED
by Digital Security Research Group · textremotehardware
https://www.exploit-db.com/exploits/10011
exploitdb WRITEUP VERIFIED
by sh2kerr · textremotehardware
https://www.exploit-db.com/exploits/10055

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/36613
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/2850
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/36969
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/507038/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/53677
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=125493484205823&w=2

Scores

EPSS 0.0650
EPSS Percentile 91.1%

Details

CWE
CWE-79
Status published
Products (35)
hp/cm8050_mfp
hp/cm8060_mfp
hp/color_laserjet_3000n
hp/color_laserjet_3600n
hp/color_laserjet_3800n
hp/color_laserjet_4700n
hp/color_laserjet_4730_mfp
hp/color_laserjet_6040_mfp
hp/color_laserjet_cm4730_mfp
hp/color_laserjet_cp3505
... and 25 more
Published Oct 13, 2009
Tracked Since Feb 18, 2026