CVE-2012-3272

Cross-site scripting (XSS) vulnerability on the HP Color LaserJet CM3530 with firmware before 53.190.9, Color LaserJet CM60xx with firmware before 52.210.9, Color LaserJet CP3525 with firmware before 06.140.3 18, Color LaserJet CP4xxx with firmware before 07.120.6, Color LaserJet CP6015 with firmware before 04.160.3, LaserJet P3015 with firmware before 07.140.3, and LaserJet P4xxx with firmware before 04.170.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securitytracker.com/id?1027841
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03556108	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:hp:color_laserjet_cm3530::::::::
	cpe:2.3:h:hp:color_laserjet_cm60xx::::::::
	cpe:2.3:h:hp:color_laserjet_cp3525::::::::
	cpe:2.3:h:hp:color_laserjet_cp4xxx::::::::
	cpe:2.3:h:hp:color_laserjet_cp6015::::::::
	cpe:2.3:h:hp:laserjet_p3015::::::::
	cpe:2.3:h:hp:laserjet_p4xxx::::::::

History

No history.

Information

Published : 2012-12-06 11:45

Updated : 2024-02-04 18:16

NVD link : CVE-2012-3272

Mitre link : CVE-2012-3272

CVE.ORG link : CVE-2012-3272

JSON object : View

Products Affected

hp

color_laserjet_cm60xx
color_laserjet_cp6015
color_laserjet_cm3530
color_laserjet_cp3525
laserjet_p3015
laserjet_p4xxx
color_laserjet_cp4xxx

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2012-3272", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-12-06T11:45:47.060", "references": [{"url": "http://www.securitytracker.com/id?1027841", "source": "hp-security-alert@hp.com"}, {"url": "https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03556108", "tags": ["Vendor Advisory"], "source": "hp-security-alert@hp.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability on the HP Color LaserJet CM3530 with firmware before 53.190.9, Color LaserJet CM60xx with firmware before 52.210.9, Color LaserJet CP3525 with firmware before 06.140.3 18, Color LaserJet CP4xxx with firmware before 07.120.6, Color LaserJet CP6015 with firmware before 04.160.3, LaserJet P3015 with firmware before 07.140.3, and LaserJet P4xxx with firmware before 04.170.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en HP Color LaserJet CM3530 con firmware anterior a v53.190.9, Color LaserJet CM60xx con firmware anterior a v52.210.9, Color LaserJet CP3525 con firmware anterior a v06.140.3 18, Color LaserJet CP4xxx con firmware anterior a v07.120.6, Color LaserJet CP6015 con firmware anterior a v04.160.3, LaserJet P3015 con firmware anterior a v07.140.3, y LaserJet P4xxx con firmware anterior a v04.170.3 permite a atacantes remotos ejecutar secuencias de comandos o HTML a trav\u00e9s de vectores no especificados."}], "lastModified": "2013-01-08T05:03:42.447", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hp:color_laserjet_cm3530:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AE16FF9-34FC-4173-9057-F894FB86EA71", "versionEndIncluding": "53.190.8"}, {"criteria": "cpe:2.3:h:hp:color_laserjet_cm60xx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "577BF556-A637-40FF-82DF-319F973A377B", "versionEndIncluding": "53.190.8"}, {"criteria": "cpe:2.3:h:hp:color_laserjet_cp3525:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC659F01-95E7-450B-88A2-5EF81F52ADF0", "versionEndIncluding": "06.140.3.17"}, {"criteria": "cpe:2.3:h:hp:color_laserjet_cp4xxx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C4401E7-5A4B-4ECB-88E7-858B7EF3DA26", "versionEndIncluding": "07.120.5"}, {"criteria": "cpe:2.3:h:hp:color_laserjet_cp6015:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E6BA04F-C4A1-45D1-AC10-42B6B1DFAFAF", "versionEndIncluding": "04.160.2"}, {"criteria": "cpe:2.3:h:hp:laserjet_p3015:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F908F88A-7579-4144-89A2-5361A4EB06D1", "versionEndIncluding": "07.140.2"}, {"criteria": "cpe:2.3:h:hp:laserjet_p4xxx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEED1BE2-9E33-45BF-A095-14195711FB10", "versionEndIncluding": "04.170.2"}], "operator": "OR"}]}], "sourceIdentifier": "hp-security-alert@hp.com"}