CVE-2009-2820

CUPS - 'kerberos' Cross-Site Scripting

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-2820 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit.

Description

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBCUPS - 'kerberos' Cross-Site ScriptingExploitDB exploitby Aaron SigelStub1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a text file describing a cross-site scripting (XSS) vulnerability in CUPS. It provides a single example URI but contains no executable code, no scanner logic, and no detailed technical analysis beyond a basic description. It is a placeholder or informational stub.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a plaintext description of a known CUPS cross-site scripting vulnerability (CVE-2009-2820). It contains a single example URI demonstrating the XSS vector, a source attribution, and a vulnerability description. No executable code, obfuscated payload, or instructions to execute anything are present. The content is purely informational and matches the expected format of an ExploitDB advisory entry.

ClassificationStub
Model confidence100%
AuthenticationNot required
Languagesen
Target softwareCUPS
Attack typesxss
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a text file that only describes a vulnerability and provides an example URI. It contains no executable code, no scanner logic, and no substantive technical analysis beyond a basic description. It is a placeholder or informational stub.

exploits/multiple/remote/10001.txt:1-19

Requirements

  • An unsuspecting user must follow a malicious URI.exploits/multiple/remote/10001.txt:1

Observed behavior

  • The provided URI is intended to execute arbitrary script code in the browser of a victim who follows the link.exploits/multiple/remote/10001.txt:5
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Uri
Payload withheldExample URI demonstrating the XSS vulnerability via the kerberos parameter.exploits/multiple/remote/10001.txt:5
Review boundaries

What the analysis did not establish

  • The artifact is a single text file with no executable code, scanner, or detailed analysis.
  • The analysis is based solely on the provided text; no external resources were consulted.
  • Only the supplied text file was reviewed; no external resources or referenced URLs were fetched or analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

Showing 12 of 16